Should Your application needs your customers to enter their information on their own personal products, then you qualify for SAQ A. Formally attest your compliance. An AOC (attestation of compliance) is the form you employ to signal that you’ve realized PCI DSS compliance. Ending your questionnaire without having “Mistaken” responses https://www.nathanlabsadvisory.com/cism-certified-information-security-manager.html