In the event your application requires your buyers to enter their info on their own individual gadgets, Then you definately qualify for SAQ A. Build firewalls and router standards, which established rules for allowing and denying use of your devices. Firewall configurations need to be reviewed bi-on a yearly basis https://www.nathanlabsadvisory.com/blog/nathan/cyber-security-consulting-solutions-by-nathan-labs-advisory-in-the-usa/