I work in an organisation that struggles to manage and maintain services.
We're rolling out an AV solution and I want to configure a single exclusion list across our entire estate to cover SQL, AD, Exchange, etc. I realise that this may lead to exclusions on a subset of servers which are irrelevant or shouldn't be excluded.
Our AV solution isn't flexible enough to have inheritable exclusion lists, so we'd need separate exclusion lists for each server type with the management overhead of updating multiple lists each time a single exclusion changes.
Is there any official (NIST, GCHQ, Microsoft, etc.) guidance on this? Theoretically it's safer to use multiple exclusion lists, however given my organisation, the effort in maintaining separate exclusion lists is likely to lead to incorrect and inconsistent configurations, which is a risk in itself.