diff --git a/manifests/baas2.pp b/manifests/baas2.pp
index 723063c32..6fced534d 100644
--- a/manifests/baas2.pp
+++ b/manifests/baas2.pp
@@ -25,6 +25,7 @@
 # @param monitor_backups   If we should monitor scheduled backups
 # @param version           The version of the client to install
 # @param backup_dirs       Specific directories to backup, default is to backup everything
+# @param exclude_list      List of exclude statements
 # @param install_tbmr      If set to true it will install "Bare Machine Recovery for Tivoli TSM (TBMR)"
 # @param tbmr_version      The version of TBMR to be installed (it has to match the version in $tbmr_url)
 # @param tbmr_url          The download URL for the TBMR installer (it has to match the version in $tbmr_version)
@@ -34,6 +35,7 @@
   Boolean       $monitor_backups=true,
   String        $version='8.1.17.2',
   Array[String] $backup_dirs = [],
+  Array[String] $exclude_list = [],
   Boolean       $install_tbmr=false,
   String        $tbmr_version='9.5.2.3206-1',
   String        $tbmr_url='https://s3.sto1.safedc.net/94f5b4f4aa674782b6bc4181943e67f1:tbmr/wab0snk8lrh6l8cjzgnaozm8siw7g7/tbmr_9.5.2.3206-1_amd64.deb',
diff --git a/templates/baas2/dsm.sys.erb b/templates/baas2/dsm.sys.erb
index 7141e3255..c86bbd09d 100644
--- a/templates/baas2/dsm.sys.erb
+++ b/templates/baas2/dsm.sys.erb
@@ -55,6 +55,12 @@ SERVERNAME SafeDC
 * https://www.ibm.com/docs/en/tsmfsm/7.1.0?topic=SSSR2R_7.1.0/com.ibm.itsm.client.develop.doc/c_encryp_transp.htm
   include.encrypt /.../*
 
+<% if ! @exclude_list.empty? -%>
+<% @exclude_list.each do |entry| -%>
+  exclude <%= entry %>
+<% end -%>
+<% end -%>
+
 <% if ! @backup_dirs_transformed.empty? -%>
 * Configure a virtualmountpoint and domain for each backup dir. Trying to use
 * include/exclude statements for this results in backing up all directory