Exempting Rules

Exemptions let you mark rules as approved deviations from the organization’s approved baseline. When a rule is exempt, the compliance script reports it as an exemption and skips remediation for that rule.

An example of this would be an organization has a requirement to enforce smart cards for login to the Mac. As part of the baseline created by mSCP, the auth_smartcard_enforce rule is included and deployed to all systems in the organization. If a user reports a lost smartcard and requires their password for authentciation. The configuration can be relaxed for auth_smartcard_enforce on the system to allow for passsword authentication.

The next time a compliance scan runs, it will be a finding, and that system may then be flagged for review. With an exemption to this rule deployed, the compliance scan can include the exemption information in the results. This will give your security team awareness that this system, while not compliant, is allowed to have this deviation.

Note

Exempt rules still log as not compliant findings but will include the “Exemption Allowed” status along with the reason for the exemption in the output.

Tip

Exemptions are not intended to be used as global exclusions from compliance scans. They should be deployed on a per-system or group basis. If complete exclusion of a rule is necessary, it should be tailored out as part of the baseline creation process. See Tailoring Rules for more information.

---

How Exemptions Work

Exemptions are stored in the audit plist file at:

/Library/Preferences/org.{baseline_name}.audit.plist

Each exempted rule has two keys:

Key	Type	Description
exempt	Boolean	true to mark as exempt
exempt_reason	String	Why the exemption is approved

---

Set an Exemption Locally

1. Set the exempt flag

   sudo /usr/libexec/PlistBuddy -c "Add :RULE_ID:exempt bool true" /Library/Preferences/org.BASELINE.audit.plist

2. Add the reason

   sudo /usr/libexec/PlistBuddy -c "Add :RULE_ID:exempt_reason string 'Your reason'" /Library/Preferences/org.BASELINE.audit.plist

3. Verify the exemption

   /usr/libexec/PlistBuddy -c "Print :RULE_ID" /Library/Preferences/org.BASELINE.audit.plist

   Output:

   Dict {
       finding = true
       exempt = true
       exempt_reason = Your reason
   }

Example: Exempt auth_smartcard_enforce from the 800-53r5_moderate baseline:

sudo /usr/libexec/PlistBuddy -c "Add :auth_smartcard_enforce:exempt bool true" /Library/Preferences/org.800-53r5_moderate.audit.plist
sudo /usr/libexec/PlistBuddy -c "Add :auth_smartcard_enforce:exempt_reason string 'Hardware reader not available'" /Library/Preferences/org.800-53r5_moderate.audit.plist

---

Deploy Exemptions via MDM

For enterprise deployments, deploy exemptions as a managed preference profile targeting the org.{baseline_name}.audit preference domain.

The compliance script checks for managed preferences and respects exemptions set through MDM.

mSCP 2.0

Tip

When generating compliance outputs with ./mscp.py guidance -s, the project creates a default audit plist in build/{baseline}/preferences/ that you can use as a template for your MDM deployment.

mSCP 1.0

Always Use the Correct Branch

The main branch is now used for mSCP 2.0 and will generate content using the mSCP 2.0 methods. For mSCP 1.0, each macOS version has its own branch (sequoia, sonoma, ventura, etc.) — check out the branch that matches your target OS.

Tip

When generating compliance outputs with ./scripts/generate_guidance.py -s, the project creates a default audit plist in build/{baseline}/preferences/ that you can use as a template for your MDM deployment.

---

Next Steps

• How to Generate Compliance Scripts - Create a script from your baseline
• What Are Compliance Scripts? - Learn more about compliance scripts
• Compliance Script Layout - Understand the script structure