Depends on what you mean by whitelist.
if you create a new incoming policy, you can turn on/off the various security/antispam engines based on the addresses, sender or receiver or both.
By subject you'll have to do something with message filters (in the cli)
