"The BOD calls on departments and agencies to identify any use or presence of Kaspersky products on their information systems in the next 30 days, to develop detailed plans to remove and discontinue present and future use of the products in the next 60 days, and at 90 days from the date of this directive"
That number of days could be critical. If they have intel telling them that Kaspersky can be used as a vector to exploit their systems by Russia, then this could be used outright to further exploit their systems and possibly (?) plant more ways to attack, even after Kaspersky has been removed.
I am assuming that DHS will already have in place another security company to handle other potential scenarios and ensure the security of their system while the transition process is happening.