diff --git a/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml
new file mode 100644
index 00000000000..34b24eb7f65
--- /dev/null
+++ b/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml
@@ -0,0 +1,34 @@
+documentation_complete: true
+
+title: 'Restrict Create/Modify Virtual Machine Cluster Instance and Preference Types'
+
+description: |-
+    Because the set of authorized subjects is specific to each environment,
+    this rule requires manual verification. Organizations can create a
+    CustomRule using CEL to automate this check by evaluating
+    ClusterRoleBindings and ClusterRoles for create and update access to
+    <tt>virtualmachineclusterinstancetypes</tt> and
+    <tt>virtualmachineclusterpreferences</tt> resources, verifying that
+    only approved subjects are bound to those permissions.
+
+rationale: |-
+    Cluster instance types and preferences govern the default hardware
+    and configuration settings applied to new virtual machines. If
+    unauthorized subjects can create or modify these resources, they
+    can introduce overly permissive settings, disable security
+    controls, or allocate excessive resources across the cluster.
+    Restricting access ensures that only approved administrators
+    define the VM profiles available to tenants.
+
+severity: medium
+
+ocil_clause: 'unauthorized subjects can create or modify cluster instance or preference types'
+
+ocil: |-
+    Run the following commands to check which subjects can create or
+    update cluster instance and preference types:
+    <pre>$ oc adm policy who-can create virtualmachineclusterinstancetypes</pre>
+    <pre>$ oc adm policy who-can update virtualmachineclusterinstancetypes</pre>
+    <pre>$ oc adm policy who-can create virtualmachineclusterpreferences</pre>
+    <pre>$ oc adm policy who-can update virtualmachineclusterpreferences</pre>
+    Verify that only authorized subjects are listed in the output.
diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile
index 9c3e034f0bb..3b321aee630 100644
--- a/products/ocp4/profiles/cis-vm-extension.profile
+++ b/products/ocp4/profiles/cis-vm-extension.profile
@@ -34,6 +34,7 @@ selections:
     - kubevirt-sriov-vlan-required
     - kubevirt-localnet-vlan-required
     - kubevirt-sriov-spoofchk-on
+    - kubevirt-restrict-vm-cluster-instance-preference-types
     - kubevirt-bridge-mac-spoof-filtering
     - kubevirt-restrict-migration-tools-access
     - kubevirt-downward-metrics-disabled