Yes, there are six exceptions, which are listed in the law. This includes:
Legacy ICT
(Incidental) Federal Contracts
National Security Systems
Undue Burden or Fundamental Alteration
ICT Functions Located in Maintenance or Monitoring Spaces
You can read more here: ICT Exceptions