National cybersecurity plans lack performance measures and estimated costs, GAO says

A GAO watchdog report criticizes the National Cybersecurity Strategy and its implementation plan for lacking outcome-oriented performance measures and cost estimates, arguing this limits the ability to gauge effectiveness and resource needs; the ONCD agrees to assess outcome-based measures but contends cost estimation is unrealistic under current budget processes, while GAO maintains estimates should be provided where applicable, citing potential metrics tied to CIRCIA-related incident reporting.