Exempting Rules

Exemptions let you mark rules as approved exceptions. When a rule is exempt, the compliance script reports it as an exemption rather than a failure, and skips remediation for that rule.

Note

Exempt rules still log as findings, but the script displays “Exemption Allowed” with your reason instead of prompting for remediation.

---

How Exemptions Work

Exemptions are stored in the audit plist file at:

/Library/Preferences/org.{baseline_name}.audit.plist

Each exempted rule has two keys:

Key	Type	Description
exempt	Boolean	true to mark as exempt
exempt_reason	String	Why the exemption is approved

---

Set an Exemption Locally

1. Set the exempt flag

   sudo /usr/libexec/PlistBuddy -c "Add :RULE_ID:exempt bool true" /Library/Preferences/org.BASELINE.audit.plist

2. Add the reason

   sudo /usr/libexec/PlistBuddy -c "Add :RULE_ID:exempt_reason string 'Your reason'" /Library/Preferences/org.BASELINE.audit.plist

3. Verify the exemption

   /usr/libexec/PlistBuddy -c "Print :RULE_ID" /Library/Preferences/org.BASELINE.audit.plist

   Output:

   Dict {
       finding = true
       exempt = true
       exempt_reason = Your reason
   }

Example: Exempt auth_smartcard_enforce from the 800-53r5_moderate baseline:

sudo /usr/libexec/PlistBuddy -c "Add :auth_smartcard_enforce:exempt bool true" /Library/Preferences/org.800-53r5_moderate.audit.plist
sudo /usr/libexec/PlistBuddy -c "Add :auth_smartcard_enforce:exempt_reason string 'Hardware reader not available'" /Library/Preferences/org.800-53r5_moderate.audit.plist

---

Deploy Exemptions via MDM

For enterprise deployments, deploy exemptions as a managed preference profile targeting the org.{baseline_name}.audit preference domain.

The compliance script checks for managed preferences and respects exemptions set through MDM.

Tip

When generating compliance outputs with -s, the project creates a default audit plist in build/{baseline}/preferences/ that you can use as a template for your MDM deployment.

---

Next Steps

• Tailoring Rules - Select rules and set ODV values
• Customize Rules - Modify rule behavior beyond ODVs