The rules were already there. Rules are worthless without enforcement. She signed the NDA stating in the first paragraph what she did was illegal. When asked about it she said she did not remember signing it and that was that.
Her and her staff are required to take OPSEC and ethics training every year, pass a test and sign it. They never took any of the required annual training. When they looked for it there was no records and it was dropped.
The rules are there. The enforcement is not. 4951