NSA hasn't filled all critical cybersecurity positions, IG says