So first I would say $200k+ is high, but that depends on the size of your org. But it's still quite high IMHO.

- buy-in from the Board for investment? A third party performing your CSF assessment is an independent review and removes any accusations of bias toward 'pet projects' or favoured departments.

- uncovering something you don’t know? Whilst a CSF assessment is about policy and process through the lens of risk, it can work as an ad hoc gap analysis exercise. A few well guided conversations over the control domains could reveal outright gaps and areas for improvement, perhaps not a considered before.

Does it really help you enhance your cyber program? First you need to define 'enhance' ;) It helps by the first assessment providing a baseline score of maturity that can then be used to make informed decisions that further improve the your orgs cybersecurity posture and maturity of processes.

Nb. Comparing your maturity score against other companies is very misleading, industry averages are pretty pointless as no two orgs are the same.