openshift · GroceryBoyJr · Aug 27, 2026
diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml
@@ -1226,6 +1226,8 @@ Topics:
     Topics:
     - Name: Supported compliance profiles
       File: compliance-operator-supported-profiles
+    - Name: OpenShift Virtualization CIS extension profiles
+      File: compliance-operator-ocp-virt-cis-profile
     - Name: Compliance Operator scans
       File: compliance-scans
     - Name: Propagating custom metadata to ComplianceCheckResult objects

diff --git a/modules/compliance-ocp-virt-cis-profile.adoc b/modules/compliance-ocp-virt-cis-profile.adoc
@@ -0,0 +1,44 @@
+// Module included in the following assemblies:
+//
+// * security/compliance_operator/co-scans/compliance-operator-ocp-virt-cis-profile.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="compliance_ocp_virt_cis_profile_{context}"]
+= About CIS Virtualization extension profiles
+
+[role="_abstract"]
+To assess {VirtProductName} workloads against CIS controls that apply when virtualization is installed, use the `ocp4-cis-vm-extension` and `ocp4-cis-vm-extension-node` profiles with the Compliance Operator.
+
+The OpenShift Virtualization CIS extension profiles extend the base CIS profiles with checks for {VirtProductName} components, such as KubeVirt and HyperConverged cluster configuration. The platform profile uses Common Expression Language (CEL) rules. The node profile uses XCCDF rules.
+
+Use these profiles on clusters where you run {VirtProductName}. They complement, but do not replace, the base `ocp4-cis` and `ocp4-cis-node` profiles.
+
+[id="compliance-ocp-virt-profile-prereqs_{context}"]
+== Prerequisites
+
+* You have installed the Compliance Operator on the cluster.
+* You have installed Compliance Operator 1.10 or later on the cluster that runs the scan.
+* You have installed {VirtProductName} if you expect platform extension checks to pass. Without {VirtProductName}, CEL rules that target virtualization custom resources can report an `ERROR` result because the required API objects are not present.
+* You have installed optional operators referenced by individual rules, such as the SR-IOV Network Operator, for those rules to pass instead of reporting `ERROR`.
+
+[id="compliance-ocp-virt-profile-pairing_{context}"]
+== Profile pairing
+
+Run the extension profiles together with the base CIS profiles and pair platform and node profiles:
+
+* `ocp4-cis` with `ocp4-cis-vm-extension` (platform)
+* `ocp4-cis-node` with `ocp4-cis-vm-extension-node` (node)
+
+Node profiles must be used with the relevant Platform profile.
+
+[id="compliance-ocp-virt-profile-rhacs_{context}"]
+== Scheduling scans from Red Hat Advanced Cluster Security
+
+Red Hat Advanced Cluster Security for Kubernetes discovers Compliance Operator profiles on secured clusters. After Compliance Operator 1.10 delivers the extension profiles, you can add `ocp4-cis-vm-extension` and `ocp4-cis-vm-extension-node` to a Red Hat Advanced Cluster Security scan configuration for a cluster that runs {VirtProductName}.
+
+In the Red Hat Advanced Cluster Security web console, the profiles appear under the existing **CIS** compliance tab. Red Hat Advanced Cluster Security does not provide a separate tab for virtualization profiles.
+
+[NOTE]
+====
+Scan results for virtualization extension rules are visible in Red Hat Advanced Cluster Security compliance coverage when the Compliance Operator integration is healthy on the secured cluster.
+====
diff --git a/modules/compliance-supported-profiles.adoc b/modules/compliance-supported-profiles.adoc
@@ -68,12 +68,33 @@ The following tables reflect the latest available profiles in the Compliance Ope
  `aarch64`
 |{product-rosa} with {hcp} (ROSA HCP)
 
+|ocp4-cis-vm-extension ^[5]^
+|CIS Red{nbsp}Hat {product-title} Benchmark — {VirtProductName} extension
+|Platform
+|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks &#8482;] ^[4]^
+|`x86_64`
+ `ppc64le`
+ `s390x`
+ `aarch64`
+|
+
+|ocp4-cis-vm-extension-node ^[5]^
+|CIS Red{nbsp}Hat {product-title} Benchmark — {VirtProductName} extension
+|Node ^[2]^
+|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks &#8482;] ^[4]^
+|`x86_64`
+ `ppc64le`
+ `s390x`
+ `aarch64`
+|
+
 |===
 [.small]
 1. The  `ocp4-cis` and `ocp4-cis-node` profiles maintain the most up-to-date version of the CIS benchmark as it becomes available in the Compliance Operator. If you want to adhere to a specific version, such as CIS v1.9.0, use the `ocp4-cis-1-9` and `ocp4-cis-node-1-9` profiles.
 2. Node profiles must be used with the relevant Platform profile. For more information, see _Compliance Operator profile types_.
 3. All earlier CIS profiles are superceded by CIS v1.9.0. It is recommended to apply the latest profile to your environment.
 4. To locate the CIS {product-title} v4 Benchmark, go to  link:https://www.cisecurity.org/benchmark/kubernetes[CIS Benchmarks] and click *Download Latest CIS Benchmark*, where you can then register to download the benchmark.
+5. OpenShift Virtualization extension profiles extend the base `ocp4-cis` and `ocp4-cis-node` profiles. Run them together on clusters that use {VirtProductName}. For more information, see _OpenShift Virtualization CIS extension profiles_.
 
 [id="bsi-profiles_{context}"]
 == BSI Profile Support

diff --git a/...rity/compliance_operator/co-scans/compliance-operator-ocp-virt-cis-profile.adoc b/...rity/compliance_operator/co-scans/compliance-operator-ocp-virt-cis-profile.adoc
@@ -0,0 +1,20 @@
+:_mod-docs-content-type: ASSEMBLY
+[id="compliance-operator-ocp-virt-cis-profile"]
+= OpenShift Virtualization CIS extension profiles
+include::_attributes/common-attributes.adoc[]
+:context: compliance-ocp-virt-cis-profile
+
+toc::[]
+
+[role="_abstract"]
+Use Compliance Operator CIS extension profiles to assess {VirtProductName} configuration on {product-title} clusters, and schedule those profiles from Red Hat Advanced Cluster Security when the Compliance Operator integration is enabled.
+
+include::modules/compliance-ocp-virt-cis-profile.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+[id="additional-resources_{context}"]
+== Additional resources
+
+* xref:compliance-operator-supported-profiles.adoc#cis-profiles_compliance-operator-supported-profiles[CIS compliance profiles]
+* xref:../co-concepts/compliance-operator-understanding.adoc#compliance_profile_types_understanding-compliance[Compliance Operator profile types]
+* link:https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/html/operating/managing-compliance[Managing compliance in Red Hat Advanced Cluster Security for Kubernetes]
diff --git a/security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc b/security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc
@@ -24,5 +24,6 @@ include::modules/compliance-profile-types.adoc[leveloffset=+2]
 [id="additional-resources_{context}"]
 == Additional resources
 
+* xref:compliance-operator-ocp-virt-cis-profile.adoc#compliance-operator-ocp-virt-cis-profile[OpenShift Virtualization CIS extension profiles]
 * link:https://access.redhat.com/solutions/6983418[Red Hat Knowledgebase Solution #6983418]
 * link:https://access.redhat.com/compliance[Product Compliance]