diff --git a/security/certificate_types_descriptions/control-plane-certificates.adoc b/security/certificate_types_descriptions/control-plane-certificates.adoc
index 142e0d3052aa..beb0730c20d1 100644
--- a/security/certificate_types_descriptions/control-plane-certificates.adoc
+++ b/security/certificate_types_descriptions/control-plane-certificates.adoc
@@ -6,19 +6,29 @@ include::_attributes/common-attributes.adoc[]
 
 toc::[]
 
+[role="_abstract"]
+Review control plane certificate namespaces and automatic rotation in {product-title} to plan maintenance and recover from expiration.
+
+[id="control-plane-certs-location_{context}"]
 == Location
 
 Control plane certificates are included in these namespaces:
 
-* openshift-config-managed
-* openshift-kube-apiserver
-* openshift-kube-apiserver-operator
-* openshift-kube-controller-manager
-* openshift-kube-controller-manager-operator
-* openshift-kube-scheduler
+* `openshift-config-managed`
+* `openshift-kube-apiserver`
+* `openshift-kube-apiserver-operator`
+* `openshift-kube-controller-manager`
+* `openshift-kube-controller-manager-operator`
+* `openshift-kube-scheduler`
 
+[id="control-plane-certs-management_{context}"]
 == Management
 
 Control plane certificates are managed by the system and rotated automatically.
 
-In the rare case that your control plane certificates have expired, see xref:../../backup_and_restore/control_plane_backup_and_restore/disaster_recovery/scenario-3-expired-certs.adoc#dr-recovering-expired-certs[Recovering from expired control plane certificates].
+If control plane certificates expire, see "Recovering from expired control plane certificates".
+
+[role="_additional-resources"]
+== Additional resources
+
+* xref:../../backup_and_restore/control_plane_backup_and_restore/disaster_recovery/scenario-3-expired-certs.adoc#dr-recovering-expired-certs[Recovering from expired control plane certificates]