CISA Open Source Software Security Roadmap

It seems a little odd for a cyber security agency to only post:

1. vague text

2. a contact email address

3. a PDF

You'd expect this from an email scam, not a .gov site with a valid SSL cert.