Thank you for reaching out to us, As I understand you for looking for information on "Cloud App Catalog", how it evaluates cloud apps.
Did a quick research, found this article https://learn.microsoft.com/en-us/defender-cloud-apps/risk-score#:~:text=app%20risk%20score.-,The%20Cloud%20App%20Catalog,-The%20Cloud%20app where cloud apps evaluates based on regulatory certification, industry standards, and best practices
Let me know if this helps you or if I misunderstood your requirement or ask let me know.