These are very good questions to start with. In addition,
Make sure you cover the following bases:
1. Security - viruses are just one thing, ask them about pen testing done, system stability, fallback options, rollback plans for deployments/changes, make them reassure you that they are rock solid.
2. integration - cover it extensively - how do they integrate (apis? connectors? own build middleware? what do they offer? if they do not offer, who do they partner with? )
3. skills - what's included in their out of the box development and service package - who (role) will help all the way through, how many man hours are they offering for support - increase this if needed.
4. roadmap - what else are they working on
5. scalability and strategy - does it align with yours.

Just the few most important points that come to mind. I am happy to support further if required. I have personally evaluated over 200 RFPs in my career.