In case your application needs your clients to enter their info on their unique devices, Then you certainly qualify for SAQ A. Review requests and talk to any questions (Professional tip- it’s essential to choose a skilled auditing organization that’s able to answer questions through the entire full audit system) https://www.nathanlabsadvisory.com/blog/nathan/secure-federal-contracts-with-fisma-compliance/