When I looked at it, they were only required to protect defense systems. For civilians, they had no strong, legal requirements. They did have a mandate to spy on them, though.This is why you can't get ahold of their TEMPEST- or Type 1-certified gear despite the nation's enemies using attacks those block with high confidence. The stuff they recommend is the stuff rated by them to be easy to moderately-difficult to attack.

So, dual nature is misleading unless you're a defense contractor or agency. The SIGINT group has all the money, power, and executive backing. That last part means even IAD's honest folks will get overruled at some point forced to compromise somehow. There's definitely people trying with the security guides, funding things like Cryptol, and so on.