diff --git a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml
new file mode 100644
index 000000000000..cc3cc635c8b1
--- /dev/null
+++ b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml
@@ -0,0 +1,32 @@
+documentation_complete: true
+
+title: 'Use Multi-Network Policies'
+
+description: |-
+    Because the required multi-network policy configuration is specific
+    to each cluster's secondary network topology, this rule cannot be
+    evaluated automatically and always reports a manual status.
+    Organizations that use secondary networks should consider creating
+    a CustomRule with a CEL expression that verifies
+    <tt>MultiNetworkPolicy</tt> resources exist in the namespaces where
+    <tt>NetworkAttachmentDefinition</tt> objects are deployed.
+
+rationale: |-
+    Secondary networks configured through Multus bypass the default
+    Kubernetes network policy enforcement. If multi-network policies are
+    not applied, workloads on those networks have unrestricted
+    connectivity, increasing the risk of lateral movement and
+    unauthorized access between virtual machines. Deploying
+    <tt>MultiNetworkPolicy</tt> resources ensures that traffic on
+    secondary networks is subject to the same segmentation controls
+    as the primary cluster network.
+
+severity: medium
+
+ocil_clause: 'multi-network policies are not in use'
+
+ocil: |-
+    Run the following command to check for multi-network policies:
+    <pre>$ oc get multi-networkpolicies -A</pre>
+    Verify that multi-network policies exist and are configured for
+    namespaces that use secondary networks.
diff --git a/build-scripts/build_cel_content.py b/build-scripts/build_cel_content.py
index 74786b6b9185..c58f3820bc51 100755
--- a/build-scripts/build_cel_content.py
+++ b/build-scripts/build_cel_content.py
@@ -339,8 +339,10 @@ def generate_cel_content(cel_rules, profiles):
         for rule_id in profile.selected:
             if rule_id not in cel_rule_ids:
                 rule_name = rule_id_to_name(rule_id)
-                raise ValueError(
-                    f"profile '{profile_name}' references unknown rule '{rule_name}'"
+                logging.warning(
+                    "profile '%s' references rule '%s' without CEL checks "
+                    "(manual rule) - skipping from CEL content",
+                    profile_name, rule_name,
                 )
 
         cel_profile = profile_to_cel_dict(profile, cel_rule_ids)
diff --git a/docs/manual/developer/13_cel_content.md b/docs/manual/developer/13_cel_content.md
index 91cbddf9c15d..d4fd977096a9 100644
--- a/docs/manual/developer/13_cel_content.md
+++ b/docs/manual/developer/13_cel_content.md
@@ -141,7 +141,7 @@ selections:
     - kubevirt-persistent-reservation-disabled
 ```
 
-**Important:** CEL profiles can only select CEL rules. If a profile includes both CEL and OVAL rules, only the CEL rules will be included in the generated CEL content file.
+**Important:** CEL profiles can select both CEL rules and manual rules (rules without `cel/shared.yml`). Only CEL rules are included in the generated CEL content file; manual rules are skipped with a build warning.
 
 ## Creating a CEL Rule
 
@@ -347,8 +347,8 @@ The build system validates CEL content automatically:
 
 **Profile Validation:**
 - `selected` field must contain at least one rule
-- All selected rules must exist in CEL rules
-- Profile cannot reference OVAL rules
+- Rules without CEL checks (manual rules) are skipped with a warning
+- Only CEL rules are included in the generated content
 
 **Content Validation:**
 - No duplicate rule names (after underscore-to-hyphen conversion)
@@ -434,9 +434,10 @@ cel-spec '{"resource": {"spec": {"enabled": true}}}' 'resource.spec.enabled == t
 **Error: `CEL profile 'profile-name' has no rules`**
 - Add rules to the `selections` field in the profile
 
-**Error: `profile 'profile-name' references unknown rule 'rule-name'`**
-- Verify the rule exists and has CEL checks (has `cel/shared.yml` with `expression` and `inputs`)
-- Check the rule ID matches the profile selection
+**Warning: `profile 'profile-name' references rule 'rule-name' without CEL checks (manual rule)`**
+- This is expected for manual rules that have no automated CEL check
+- The rule will be skipped from CEL content output but remains in the profile selections
+- If this is unintentional, verify the rule has `cel/shared.yml` with `expression` and `inputs`
 
 ### CEL Content Not Generated
 
diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile
index a988efb13ced..374822c9e50f 100644
--- a/products/ocp4/profiles/cis-vm-extension.profile
+++ b/products/ocp4/profiles/cis-vm-extension.profile
@@ -31,3 +31,4 @@ selections:
     - kubevirt-no-vm-device-passthrough
     - kubevirt-no-shareable-disks
     - kubevirt-disk-error-policy-not-ignore
+    - kubevirt-use-multi-network-policies