diff --git a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml
new file mode 100644
index 000000000000..cc3cc635c8b1
--- /dev/null
+++ b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml
@@ -0,0 +1,32 @@
+documentation_complete: true
+
+title: 'Use Multi-Network Policies'
+
+description: |-
+    Because the required multi-network policy configuration is specific
+    to each cluster's secondary network topology, this rule cannot be
+    evaluated automatically and always reports a manual status.
+    Organizations that use secondary networks should consider creating
+    a CustomRule with a CEL expression that verifies
+    <tt>MultiNetworkPolicy</tt> resources exist in the namespaces where
+    <tt>NetworkAttachmentDefinition</tt> objects are deployed.
+
+rationale: |-
+    Secondary networks configured through Multus bypass the default
+    Kubernetes network policy enforcement. If multi-network policies are
+    not applied, workloads on those networks have unrestricted
+    connectivity, increasing the risk of lateral movement and
+    unauthorized access between virtual machines. Deploying
+    <tt>MultiNetworkPolicy</tt> resources ensures that traffic on
+    secondary networks is subject to the same segmentation controls
+    as the primary cluster network.
+
+severity: medium
+
+ocil_clause: 'multi-network policies are not in use'
+
+ocil: |-
+    Run the following command to check for multi-network policies:
+    <pre>$ oc get multi-networkpolicies -A</pre>
+    Verify that multi-network policies exist and are configured for
+    namespaces that use secondary networks.
diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile
index 9c3e034f0bb9..18ed330ae882 100644
--- a/products/ocp4/profiles/cis-vm-extension.profile
+++ b/products/ocp4/profiles/cis-vm-extension.profile
@@ -30,6 +30,7 @@ selections:
     - kubevirt-enforce-trusted-tls-registries
     - kubevirt-no-vm-device-passthrough
     - kubevirt-no-shareable-disks
+    - kubevirt-use-multi-network-policies
     - kubevirt-disk-error-policy-not-ignore
     - kubevirt-sriov-vlan-required
     - kubevirt-localnet-vlan-required