diff --git a/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml
new file mode 100644
index 000000000000..053078222d37
--- /dev/null
+++ b/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml
@@ -0,0 +1,30 @@
+documentation_complete: true
+
+title: 'Restrict Update Access to the CDI CR'
+
+description: |-
+    Because the set of authorized subjects is specific to each
+    organization, this rule requires manual verification. Organizations
+    can create a compliance-operator CustomRule with CEL expressions
+    that evaluate ClusterRoleBindings and Roles to verify that only
+    their approved subjects hold update access to CDI resources.
+
+rationale: |-
+    The CDI custom resource governs the data import pipeline for
+    virtual machine disk images in OpenShift Virtualization. Modifying
+    this resource can change upload proxy settings, scratch space
+    allocation, and image import behavior. If unauthorized subjects
+    can update the CDI CR, they may introduce insecure import sources,
+    weaken transport security, or disrupt the disk image provisioning
+    workflow. Restricting update access ensures that only approved
+    administrators can alter CDI configuration.
+
+severity: medium
+
+ocil_clause: 'unauthorized subjects can update the CDI CR'
+
+ocil: |-
+    Run the following command to check which subjects can update the
+    CDI custom resource:
+    <pre>$ oc adm policy who-can update cdi</pre>
+    Verify that only authorized subjects are listed in the output.
diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile
index 9c3e034f0bb9..acc0c209db19 100644
--- a/products/ocp4/profiles/cis-vm-extension.profile
+++ b/products/ocp4/profiles/cis-vm-extension.profile
@@ -36,6 +36,7 @@ selections:
     - kubevirt-sriov-spoofchk-on
     - kubevirt-bridge-mac-spoof-filtering
     - kubevirt-restrict-migration-tools-access
+    - kubevirt-restrict-update-access-to-cdi-cr
     - kubevirt-downward-metrics-disabled
     - kubevirt-ksm-disabled
     - kubevirt-no-jsonpatch-annotations