What it covers. NIST guidance on the security of full virtualisation, where hypervisors run complete guest operating systems. It covers threats to hypervisors, guest operating systems and virtual networks, and recommendations for planning and deploying virtualised environments securely.
In practice. Applying it well means hardening and patching hypervisors, restricting and protecting administrative access to the virtualisation management layer, separating management networks and controlling how virtual machines are created, copied and retired. Evidence includes hypervisor configuration standards, access controls on management consoles and inventories of virtual machines.
Common gaps. Typical gaps are management interfaces reachable from general networks, dormant virtual machines left unpatched and broad administrator rights over the whole virtual estate. The guide dates from 2011, so it predates many cloud practices.