The first three qualifications I would look for when selecting a vendor are ...
1. Can they do what we want them to do? That may not be as simple as it sounds; you may want to include all the very subtle qualifications such as do they really know "about your business" (what you do, why, to/for who, what makes you tick). Building something merely to meet my cold, hard, written requirements, and building something that meets my written requirements but also includes knowing WHY I wanted it built can be the difference between a mediocre product and a great product.
2. Can they do it in the manner that we want them to do it? Can they and will they comply with all of our flow-down process and regulatory requirements (as Norbert Kubilus discussed)? If we have been contracted to build a product for a highly-demanding client (and/or one that operates in a strictly-regulated industry), the client will flow down process and regulatory requirements (e.g. "do it this way", "maintain these records as proof of compliance", "assess your work practices on a regular basis to prove that you are constantly in compliance", etc.) to us. Any vendors I sub-contract will also have to meet these requirements.
3. Can they be trusted? Will they provide the product or service on time? Will they provide services in compliance with flow-down process requirements? Will they promise not to use or pass on any intellectual knowledge that has been transferred to them (other than in our contracted business)?