She screwed up big time. At the very least she should have done this:
While it may be necessary to use private e-mail for official business under emergency circumstances (e.g. when official email is not available), it is imperative that those e-mails become part of the official record. In this situation, the easiest way to accomplish this is to simply "cc" your work e-mail on any work correspondence sent from your private e-mail. Also, it is 100% inappropriate and against regulations and policy to send any FOUO, PII or other sensitive but unclassified data via a personal email account. This data must be sent on an official email system and digitally signed and encrypted.
|