Define what is included as user stories or scenarios: who does what, and what happens next. Just as important, state explicitly what the first release deliberately excludes.
The number in the proposal is rarely the total cost. Expect infrastructure, paid APIs, monitoring and a maintenance allowance each year.
The mix of people behind the number matters a great deal.
Finally, say what you expect back. Ask for a breakdown by feature or module, the assumptions used, whatever the team considers risky and a range rather than a single figure.
Last, look at the working rhythm. Confirm how much working-time overlap the teams will share with your working day, which named person is expected to answer day-to-day questions and on what response times.
Finally, plan for the end of the engagement before it becomes urgent. Require that the source repository stays in your organisation from day one, and that a readme and architecture notes are kept current as the code changes.
The requirements nobody writes down can easily double the number. An internal tool used by twenty people is a very different build from the same idea handling thousands of external customers.
The contract deserves more scrutiny than the proposal. Three clauses do most of the work: ownership of the code, the NDA, and termination and handover.