Access control grants: NSGP rules for doors, locks, and entry systems

What the access control entries cover

The FY2026 NSGP notice of funding opportunity (NOFO) describes code 14SW-01-PACS, "System, Physical Access Control," in one line (p. 62):

"Locking devices and entry systems for control of physical access to facilities."

A door project can draw on other codes as well. 14SW-01-DOOR covers "[r]einforced doors and gates with increased resistance to external impact for increased physical security." 04AP-05-CRED covers software and hardware "for creating site/event credential badges and controlling scene access" and notes that the function "may also be obtainable via subscription as a cloud-based service." 14SW-01-SIDP covers "[s]ystems for positive identification of personnel as a prerequisite for entering restricted areas," and 14SW-01-ALRM includes door and window switches that detect access violations (pp. 59, 62). Installation goes under 21GN-00-INST, and the allowable-costs guide lists every code.

Impact-resistant doors and gates and physical access control systems ranked second and third among the equipment types nonprofits requested and received the most NSGP funding for in FY2025 (FY2026 NOFO, p. 9). A door bought for bullet resistance is a different question, covered under ballistic protection grants.

Items the equipment list doesn't name

The FY2026 list has no entry for visitor management systems, panic or duress buttons, or video intercoms at a door. Its only intercom code, 06CP-03-ICOM, describes a "[c]ommunication system for a limited number of personnel in close proximity to receive alerts or notifications" (p. 61). Whether any of these items fits a listed code is a question for your State Administrative Agency (SAA). Equipment outside the list needs FEMA's prior approval (p. 64).

Face-reading door readers need the same caution. The NOFO bars facial recognition software in the camera, video analytics, and vehicle identification entries. The personnel identification entry carries no such note, and the NOFO doesn't say whether a face reader at a door falls under the bar. Ask the SAA in writing before you include one.

Approval gates before you buy

An NSGP award doesn't approve a door design. The NOFO requires equipment to "meet all mandatory statutory, regulatory, and FEMA-adopted standards ... including the Americans with Disabilities Act" (p. 64). Fire, building, and life-safety codes are adopted, and sometimes amended, by each state or locality, and the official who enforces them is the authority having jurisdiction (AHJ), such as the building official or fire marshal. Bring in the AHJ and a qualified designer (an architect or fire protection engineer, for example) before you sign a contract, and show them the proposed locking arrangement for each door.

Free egress comes first

NFPA 101, the Life Safety Code, lets exterior exit doors be locked from the outside to control entry. From the inside, occupants "must be able to exit the building without needing a key, tool, or special knowledge or effort to open the door" (NFPA, School Safety and Security Update, September 2019). NFPA offers free online access to NFPA 101 at nfpa.org/101. Your jurisdiction may enforce NFPA 101, the International Building and Fire Codes, or both, each in a particular edition.

Why a magnetic lock alone doesn't pass

NFPA 101 allows electrically locked egress doors only under specific release arrangements. NFPA's technical committee text for the next edition of NFPA 101 (First Revision report, 2024) permits sensor-release electrical locking only where the occupancy chapter allows it, and only when all of these hold:

• a sensor on the egress side unlocks the door when it detects someone approaching;
• losing power to the sensor or the lock unlocks the door;
• a manual release marked "PUSH TO EXIT" (or, in the draft, a contactless release marked "WAVE TO EXIT") sits 40 to 48 inches above the floor and within 60 inches of the door, cuts power to the lock directly, independent of the locking system electronics, and keeps it unlocked for at least 30 seconds;
• activation of the fire alarm, sprinkler or fire detection system, where the building has one, unlocks the door until the system is manually reset;
• new installations have emergency lighting on the egress side; and
• new electromechanical or electromagnetic locking hardware is listed to UL 294 or UL 1034.

The draft allows a second arrangement: release hardware on the door leaf, usable with one hand, that "directly and immediately interrupts the power supply to the electric lock" and unlocks when power is lost. The committee's example is panic hardware with an internal switch that cuts power to an electromagnetic lock at the top of the door. Delayed-egress locks fall under a separate provision with conditions of their own.

This is draft committee text, not the adopted code, and section numbers and details differ between editions. The Arlington, Texas Fire Marshal's Office access control guide (2021 IFC edition, updated March 2025) applies a similar list under the International Fire Code. It requires a "PUSH TO EXIT" device that interrupts lock power "independent of other electronics," automatic unlocking when a fire alarm, sprinkler, or fire detection system is activated, where one is provided, and locking units listed to UL 294.

In our reading of both texts, a magnetic lock that releases only when someone presents a card, enters a code, or uses an app meets neither arrangement by itself. Use these lists as questions for the AHJ. The designer and the AHJ decide what a compliant door looks like in your building.

Classroom and office locks

Locking a classroom against an intruder is allowed under conditions. NFPA's 2019 update says the 2018 edition of NFPA 101 allows two kinds of classroom locks, and both must meet the same performance criteria: the door can be locked without opening it; engaging or releasing the lock from the classroom side needs no key, tool, or special knowledge; the two releasing operations aren't required at the same time; the lock sits 34 to 48 inches above the floor; the door can be unlocked and opened from outside with a key or credential; and staff are drilled. The second kind, for existing doors only, is secondary hardware such as a thumb-turn deadbolt.

Building codes add their own conditions. Ohio's building code section 1010.2.8, as reproduced in the Columbus Fire Prevention Bureau's temporary door locking guideline, lets egress doors from classrooms, offices, and other occupied rooms in Group E, Group B educational, and Group I-4 occupancies lock against intruders if the door can be unlocked from outside "with a key or other approved means," opens from inside as the egress section requires, and the work makes no "[m]odifications ... to listed panic hardware, fire door hardware or door closers." Changes to fire door assemblies follow NFPA 80.

These provisions are written for those occupancy groups, so the AHJ's interpretation controls for classrooms, offices, or children's areas in a house of worship. Schools also have funding routes beyond NSGP; see security grants for private and religious schools.

Barricade devices and temporary locks

NFPA's answer on barricades is no: NFPA 101 "requires doors to be readily opened from the classroom side." Its 2019 update says after-market locking and barricade devices, wedges, rope, and chains violate that rule and can slow or block first responders or let an intruder trap people inside.

State law can differ. Florida's statute for school districts and charter schools, s. 1006.07(6)(f), lets classrooms with a permanently installed lock also use temporary door locks during an active assailant incident. The temporary lock must be able to be engaged or removed without opening the door, must be "easily removed in a single operation from the egress side of the door without the use of a key," may be installed at any height, must "otherwise be in compliance with the Florida Fire Prevention Code," and must be integrated into the active assailant response plan. In Ohio, the Columbus guideline marks temporary door locking devices "Permit Required" and reproduces a state fire code provision that does not give the fire code official authority to approve or prohibit a device "approved and used in conformance with the rules developed by the Ohio Board of Building Standards." Check your own state's law, and ask the AHJ in writing before you buy any temporary or after-market locking device.

Accessible hardware and readers

The NOFO's ADA requirement reaches door equipment. The U.S. Access Board's guide to the 2010 ADA Standards explains that door hardware must allow one-hand operation without "tight grasping, pinching, or twisting of the wrist" and sit 34 to 48 inches above the floor, and it states that "[r]ound door knobs do not comply." Accessible doors have a 5-pound maximum opening force, with exceptions for fire doors and exterior hinged doors. The Board's operable parts guide sets a 15 to 48 inch unobstructed reach range. It says the standards apply only to the fixed parts of a lock, so keys and access cards themselves don't have to comply. It doesn't name card readers or keypads, so ask the designer how the reach and clear floor space rules apply to each one.

Title III of the ADA does not apply to "religious organizations or entities controlled by religious organizations, including places of worship" (42 U.S.C. 12187). The NOFO still names the ADA among the standards NSGP equipment must meet. FEMA's Preparedness Grants Manual (section 4.5) also requires recipients that use grant funds to build or alter buildings to follow local accessibility codes, Section 504 of the Rehabilitation Act, the Architectural Barriers Act, and the ADA. Your SAA can tell you how it applies those requirements to a door project.

Permits, inspections and the building owner

Permit and inspection rules are local. Arlington's guide requires online permits, warns that work "without an approved permit may result in a triple permit fee in addition to citations and fines," and has inspectors test magnetic locks, backup power, release on power loss, the fire alarm connection, manual operation, and free egress. Ask the AHJ before purchase whether your project needs a permit, plan review or inspection, and build that time into the schedule.

If you lease the building, get the owner's consent in writing, and ask the SAA what proof it wants. FEMA's FY2024 NSGP FAQ says "any work funded by the NSGP must be permissible by the owner." How the system behaves during a power outage is a design question for the designer and the AHJ. The equipment list includes uninterruptible power supply (10PE-00-UPS) and generator (10GE-00-GENR) codes if backup power is part of the design (NOFO, p. 61).

Environmental review for door and lock work

FEMA's EHP screening form names "access control for an area, building, or room" and "security door installation or upgrades" among the physical security enhancements that need environmental and historic preservation (EHP) screening; only mobile or portable equipment with no installation is exempt. The form asks the year each building was built, any significant modifications to a building over 45 years old, whether a structure 50 years old or older is in or next to the project area, and whether the site is on the National Register or in or near a historic district. Its instructions say consultation with the State Historic Preservation Office "may be required" for structures more than 50 years old or on the National Register.

A door replacement or new opening can raise a second question. The NOFO says "the installation of equipment may constitute construction and/or renovation," which needs FEMA's prior written approval, an SF-424C budget and SF-424D assurances, and a cost cap of "the greater amount of $1 million or 15% of the NSGP award" (pp. 66–67). The NOFO doesn't define where a door project crosses that line; it tells applicants to contact their Preparedness Officer, so ask the SAA to put the question to FEMA before you budget. The EHP review guide covers the screening package and timing.

Networked systems and ongoing costs

The NOFO lists "[i]mproving cybersecurity of access control and identify [sic] verification systems" as an example project under its cybersecurity priority (p. 13), and a hosted access control service can fall under code 04AP-11-SAAS, which is "limited to those services that support security systems such as access controls" (p. 60). Where an access system includes networked controllers, video, or cloud components, apply the Section 889 component check described in security camera grants. That page also covers how long licenses, subscriptions, and maintenance bought with grant funds can run.

What the application needs to show

The NOFO's review criteria look for alignment between the requested projects and the vulnerabilities in the site's vulnerability assessment, and the NOFO says grant projects must be "both feasible and effective at mitigating the identified vulnerability" (pp. 30–31). Each door in the request should trace to a vulnerability the assessment identifies. CISA's Physical Security Performance Goals for Faith-Based Communities (December 2023) recommend that organizations "[l]ock and install alarms on windows and doors, ensuring they can be unlocked for emergency escape," and "[i]ncorporate access control for critical areas such as IT/electrical rooms, finance offices, and children's ministries."

For each door, record what it needs to do (stay locked, admit people by credential, lock down on command, or release for egress), the door and frame type, whether it is fire rated, the existing hardware, who will issue and revoke credentials, power and network needs, the AHJ's comments, and the AEL code for each budget line. Describe the performance rather than a brand. The vendor guide explains what a neutral quote includes.

Free planning resources

CISA's Protecting Houses of Worship page offers its performance goals, online and paper versions of its Houses of Worship Security Self-Assessment, and its Protective Security Advisors. For schools, SchoolSafety.gov's Targeted Violence page covers physical security and lists the CISA K-12 School Security Guide Product Suite and a Justice Department overview of physical security measures.

The Partner Alliance for Safer Schools (PASS) publishes K-12 safety and security guidelines at passk12.org. PASS is a private coalition, formed in 2014 through a partnership led by two security-industry associations, and the FY2026 NOFO doesn't mention it. Its guidelines are one reference to weigh with your assessor and AHJ; NSGP doesn't require them.