A metric catalog is a governed list of security measurements that defines what each metric means, how it is calculated, who owns it, and when it is updated. In practice, it acts as the reference standard for reporting, so the same number means the same thing across dashboards, spreadsheets, and board packs.
In cyber security, a metric catalog matters because attackers exploit confusion, while defenders need consistency. If one team counts vulnerabilities by asset and another by finding, or if time windows differ between SIEM and EDR reports, leadership may get misleading results. A catalog reduces drift, supports auditability, and preserves lineage from raw telemetry to executive metrics. It is commonly used when combining data from identity, cloud, endpoint, and vulnerability tools into a single view of risk. Good catalogs also help defenders spot real trends, such as rising exposure or slower patching, instead of noise created by changing definitions.