Are we really this far behind in Cyber Security in the federal government?

The lack of accountability drives these failures. From VA failures to cyber hacks, when no one is held accountable, you can be sure it will happen again.

This does not surprise me at all.

This comes down to a lack of knowledge and experience at the top. The leadership at the top doesn't realize that with how fast technology moves and changed, you also have to change and adapt. You get what you pay for and when you hire cheap labor you get the person with paper certs, no experience, and can't add a user to active directory, let alone create a script, or run cyber ops. It takes more than just certifications to prove your worth in cyber, and if you truly want the best, than you have to make it more worth while than those on the darknet.