An exemption is a rule-based exception that removes a specific product, system, or case from a broader requirement. In practice, it means the rule still applies generally, but a narrower set of items is treated differently because of technical limits, cost, safety, or regulatory tradeoffs. Exemptions are common in policy, compliance, and engineering, where one-size-fits-all rules can be impractical.
In cyber security, exemptions matter because they can create controlled gaps in a baseline requirement such as patching, encryption, logging, or device hardening. Defenders may grant temporary exemptions for legacy systems, specialized hardware, or operational constraints, but each exception increases risk and should be documented, approved, and reviewed. Attackers often look for these outliers, since exempted assets may miss protections that the rest of the environment has. Good security programs track exemptions carefully, set expiration dates, and compensate with monitoring or compensating controls.