There is mandamus language that directs the DHS Director to "bolster the security of open source software", "support Federal efforts to strengthen the security of open source software", etc. but it's up to the director to determine the methods of doing so.