Having a comprehensive IT security policy in place indicates that the vendor takes data security and privacy seriously. If you provide your company data to them, you need to know that it will be used according to the agreed purposes.
Look for a vendor that has established practices and processes already in place to ensure data isn't being used or accessed by unauthorized individuals or parties. Their IT security policy should include an acceptable use policy, data security policy, and data classification policy.