Why Spend $2 Billion on Cybersecurity Metrics?

Infrastructure Security Agency, CISA, recommending a metrics package that will cost over $2.5 billion and impact companies when they need to be focused on recovery? Maybe it's to make some pretty charts. As a strong advocate of good cybersecurity metrics, I think this is overkill and a waste of valuable resources that could be applied to actually make companies more resistant and resilient to attacks. And the development of government programs that target the attackers themselves. Cybersecurity metrics are great, but not $2.5 billion great. Let's scale it down.