The NSA's IT (overall, and security) has gone way downhill, by all accounts I've seen, in the past 20 years. It's no longer superior to good commercial practice in theory, just has more money for the same mission.

There have been lots of accounts of how badly they've botched acquisition problems, and it's all essentially run by contractors now.