
Once you have the documented requirements, locate all the unknowns. Overestimate these items. Put together a list of deliverables to manage expectations. Remember to cost in security the first time around. There may also need to be time factored in for developer training.
This might be obvious, but you need a lot of time for testing. The current fix I am doing requires double the amount of time testing as it does coding. This should be the norm and not the exception. Get your developers to agree to the estimate, and more importantly the deadlines.
Add some slack in, no matter how well you think your estimate is. The estimation phase is the toughest one. Don't cave in to pressure to reduce the estimate. That will only lead to disaster.