Japan’s Economic Security Promotion Act has now been in effect for over a year. IT governance frameworks that predate the Act have shortcomings and need to be reassessed in light of new risks. Meanwhile, new issues have emerged, including treatment of ISMAP-certified cloud services and inclusion of network hardware in the reviews mandated by the Act.