They must have a backup system in place

The backup system must be automating daily backups and you will need easy access to the backups in case you need to do a site restore. Recommend they set their site up on ManageWP or offer to set them up on your account or use BackupBuddy or VaultPress, all of which are tailor made for WordPress. Make sure you dont collect login info to anything they own until they confirm their site is being backed up! You do not want anyone to be able to point fingers at you if anything goes wrong, just because you had access, even if it wasnt you who did the deed. Its not worth the pocket change to take on a job without this requirement.