I'm sure it depends on revenue, the amount of personal data, and the nature of the business. I don't know how the rates are calculated but I've helped fill out

I'm sure it depends on revenue, the amount of personal data, and the nature of the business. I don't know how the rates are calculated but I've helped fill out the paperwork on a few applications and it's not dissimilar to what you might have to go through to become an approved technology partner with a Fortune 100 company. Do you have a disaster recovery policy? If so, when was it last tested? Do you get pen tests? What was the result of the last one? Are there any open items? Describe the technical access controls around customer data. Describe the physical security measures in place around your servers and IT infrastructure. Keep in mind that you don't need to necessarily "prove" things that can be checked later. The insurance company is happy to take your word that there's no PCI card data on your network and cash your premiums. If there is and it gets stolen in a hack they simply won't pay out.