diff --git a/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml
new file mode 100644
index 000000000000..da5da129467d
--- /dev/null
+++ b/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml
@@ -0,0 +1,30 @@
+documentation_complete: true
+
+title: 'Restrict VNC Access to Cluster Workloads'
+
+description: |-
+    Because the set of authorized subjects is specific to each
+    organization, this rule requires manual review. Organizations can
+    create a CustomRule using CEL to automate this check by querying
+    RoleBinding resources and verifying that only approved subjects
+    are bound to the <tt>token.kubevirt.io:generate</tt> role.
+
+rationale: |-
+    VNC provides direct graphical console access to a running virtual
+    machine. In an OpenShift Virtualization environment, this access is
+    gated by the <tt>token.kubevirt.io:generate</tt> role. If this role
+    is bound too broadly, unauthorized users can view and interact with
+    VM desktops, capture screen contents, and input commands. Restricting
+    VNC access through careful role binding review ensures that only
+    approved subjects can establish console sessions to cluster
+    workloads.
+
+severity: medium
+
+ocil_clause: 'unauthorized subjects have VNC access to cluster workloads'
+
+ocil: |-
+    Run the following command to list role bindings that grant VNC access:
+    <pre>$ oc get rolebinding -ojson | jq -c '.items[] | select(.roleRef.name | contains("token.kubevirt.io:generate"))'</pre>
+    Verify that only authorized subjects are bound to the
+    <tt>token.kubevirt.io:generate</tt> role.
diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile
index 9c3e034f0bb9..f3c2728310bf 100644
--- a/products/ocp4/profiles/cis-vm-extension.profile
+++ b/products/ocp4/profiles/cis-vm-extension.profile
@@ -28,6 +28,7 @@ selections:
     - kubevirt-persistent-reservation-disabled
     - kubevirt-no-vms-overcommitting-guest-memory
     - kubevirt-enforce-trusted-tls-registries
+    - kubevirt-restrict-vnc-access-to-workloads
     - kubevirt-no-vm-device-passthrough
     - kubevirt-no-shareable-disks
     - kubevirt-disk-error-policy-not-ignore