Is there a lower cost cryptography than elliptic-curves based cryptography? ECC requires less CPU power, less memory and shorter keys than RSA or any other asymmetric cryptography I came across in the literature (correct me if I am wrong).

Is there a lower cost asymmetric cryptography than elliptic-curves based cryptography?
In fact, for public-key operation (message encryption and signature verification, as opposed to message decryption and signature generation), RSA and, even more, the Rabin cryptosystem, outperform ECC. This may matter to, for instance, low-power embedded systems that try to connect to a powerful server with a TLS-like protocol.

In the domain of signatures, signature size can also be an important parameter. A plain signature based on elliptic curves (ECDSA, EdDSA) will use about 512 bits (64 bytes) for the customary "128-bit" security level. The BLS scheme does twice better (256-bit signatures) through the use of pairing-friendly curves, which are a very special kind of curve with complicated mathematics, and a substantially higher computational cost. Some multivariate cryptographic schemes can conceptually yield both even shorter signatures and faster operations.

For asymmetric encryption, it is known that the McEliece cryptosystem offers really fast operations (but public and private keys are much larger).

There is currently a flurry of activity with "post-quantum schemes" that offer various additional performance trade-offs; notably, some Ring-LWE schemes have public-key operations that outperform even RSA.

Asymmetric cryptography performance is not a simple metric; many features are amenable to measurement, such as speed of public-key operations, speed of private-key operations, signature size/overhead, encryption overhead, public key size, private key size, implementation RAM and ROM usage,... Classic elliptic curve cryptography tends to perform well in each of these, but for each category, there are other algorithms that outperform them.