NIST Recommends Agencies Assume They Have Already Been Hacked

The Security Measures publication focuses on running software, while the Recommended Minimum Standards focuses on developing it.