Security grants in California: NSGP and the state nonprofit program, both through Cal OES

Status on October 14, 2026

The California Governor's Office of Emergency Services (Cal OES) runs two separate security grants. As the State Administrative Agency (SAA), it administers FEMA's Nonprofit Security Grant Program (NSGP). It also runs the state-funded California State Nonprofit Security Grant Program (CSNSGP). The two cycles don't line up, so check each row.

NSGP and CSNSGP side by side

Each column reflects the latest round, and the next round can change any row. NSGP basics are in the NSGP program guide.

Federal NSGP: how Cal OES took FY2026 applications

Cal OES's Infrastructure Protection Grants Unit runs NSGP and answers questions at Nonprofit.Security.Grant@caloes.ca.gov. For FY2026 there was no portal, access-request step or FAQ, and the package went to that inbox by email. A Unique Entity ID (UEI) wasn't needed in the packet, only after selection for a subaward (Cal OES FY2026 webinar slides).

FEMA published the FY2026 notice on June 24, 2026. Cal OES posted its instructions June 29, held webinars June 30 to July 2, and closed submissions July 10. Information Bulletin 579 later moved FEMA's deadline for SAAs to July 31, but Cal OES's memos page lists no memo moving the July 10 date. Cal OES's slides set the FY2026 subaward period from September 1, 2026, to May 31, 2029, three months shorter than FEMA's period of performance.

The FY2026 package

Cal OES took three documents per location, as separate attachments to one email for that location. Its slides say: "No other documents will be accepted."

Late, misaddressed, incomplete, scanned, altered, prior-version, combined, linked, zipped, resubmitted, and duplicate filings were not considered (GMM 2026-11). Subject lines followed a set pattern in the webinar slides, FY2026_NSGP_UA_CA_<UrbanArea>_<NonprofitName> or FY2026_NSGP_S_CA_<NonprofitName>, and file names added suffixes such as _Mission. The general sequence is in how to apply for NSGP.

Where California's rules differ

Cal OES scores the IJ on FEMA's 40-point matrix, and its slides give risk the most weight: 15 points, against 9 for facility hardening, 5 each for background and milestones, 4 for impact, and 2 for project management. The Investment Justification guide covers each section.

Vulnerability assessments

Cal OES's slides say the VA Worksheet "is not scored" and that who conducted the assessment, or how, "is not reviewed." In the IJ, equipment that doesn't tie to the assessment's findings "may not be funded or may be placed on hold by FEMA." An earlier assessment can be reused if it is still current and applicable, with its results moved onto the current worksheet. If a security company prepares the assessment, Cal OES says it may not bid on or contract for the installation, under the competition rule in 2 CFR 200.319(b).

NSGP can't pay for the assessment (FY2026 NOFO), but Cal OES's Critical Infrastructure Protection team helps at va@caloes.ca.gov or (888) 788-7983, and the slides list six threat assessment centers. See the vulnerability assessment guide for timing and content.

Urban area or state stream

Each site's physical address sets its stream. NSGP-UA (Urban Area) covers California's six designated urban areas, and NSGP-S (State) covers every other site. The FY2026 NOFO disqualifies an application in the wrong stream.

These are total federal allocations from the NOFO's Appendices B and C, as in our state-by-state table. Each includes the 5% that Cal OES may keep for M&A. Cal OES quotes California's allocation as $28,933,441 (GMM 2026-11), which is the same money without that 5% share.

Two footprints don't follow county lines. The Los Angeles/Long Beach area is defined by city, so a site elsewhere in Los Angeles County may belong in NSGP-S, and the Riverside area covers only the places Cal OES lists. Monterey and San Benito counties fall inside the Bay Area. Check each address against slides 7 to 10 of the FY2026 webinar. For a site near a boundary, get Cal OES's answer in writing instead of relying on Cal OES to correct the stream.

California State Nonprofit Security Grant Program (CSNSGP)

CSNSGP is California's own program, with its own inbox (CSNSGP@caloes.ca.gov), forms, scoring and award system. The 2025-26 round offered $76,000,000 for "target hardening and other security enhancements" (FY2025 CSNSGP RFP).

Who can apply and what it pays for

Applicants must be California nonprofits described in section 501(c)(3) and exempt under 501(a). The RFP notes that churches, mosques, and synagogues are automatically exempt if they meet those requirements. Each proposal covers one site the applicant occupies when it applies, so P.O. boxes, vacant lots, and sites under construction are out, and only one nonprofit per building may apply. An applicant picks one track; a proposal for both loses Individual eligibility.

• Individual: up to two proposals, at up to $250,000 per location and $500,000 in total.
• Support Services: one proposal of up to $500,000 to give other eligible nonprofits vulnerability assessments, security training, mass notification alert systems, monitoring and response systems, or lifesaving emergency equipment. The funds can't benefit the applicant, which must name each nonprofit it supports and, if selected, hold a contract with each one.

Individual awards can pay for planning, training fees and materials, contracted security, and up to 5% for M&A. They can also pay for construction or renovation up to $100,000 and for security equipment installed on owned or leased property, such as reinforced doors and gates, high-intensity lighting and alarms, screening systems, and access control. Contracted security can't exceed 50% (the RFP measures it against the request, the State Guidance against the total subaward), and the organization must be able to sustain it without the grant. Neither document refers to FEMA's AEL. The RFP also allows "any other security enhancement consistent with the purpose of the CSNSGP."

The State Guidance excludes equipment for contracted guards, weapons and ammunition, travel, permanent personnel, hiring public safety personnel, overtime and backfill, operating expenses, and costs outside the period of performance. It also says virtual or 24/7 monitoring by security system companies isn't contracted security personnel. The RFP mentions cybersecurity only in its description of training and programs, so ask Cal OES before budgeting cyber equipment.

How the 2025-26 round worked

Cal OES released the RFP on October 31, 2025, and took proposals by email until 11:59 p.m. Pacific time on December 12, 2025. Support Services proposals were due January 12, 2026 (RFP addendum). Each location needed its own email with the Application Form and VA Worksheet (both Version 10/25) and supporting documents. Those were proof of ownership or a lease, a landlord's permission letter for tenants, a facility map or footprint with square footage, a justification for multi-level or dual-use buildings, and a parent organization's letter if the applicant uses the parent's Federal Employer Identification Number. The RFP's rejection rules match Cal OES's NSGP list, and it says to email Cal OES if no confirmation arrives within two business days.

The VA Worksheet may be a self-assessment, but every vulnerability on it must be "up-to-date and not being addressed by any other funding received." During scoring, Cal OES checks the legal name and address with the Franchise Tax Board, the Department of Justice, and the Secretary of State. Inconsistent information can cost points, and an applicant Cal OES can't verify may be found ineligible. Use the name on the IRS determination letter or the exact Secretary of State registration.

The RFP scores 48 points: applicant information 5, background 7, risk 12, security enhancements 14, milestones 5, and impact 5. A proposal needs 40 points to be considered, and the two tracks are ranked separately. Funding history isn't considered in selection. The Director of Cal OES makes the final decisions, weighing the ranked score, "including whether an Applicant is more likely to be a target of hate-motivated violence based on the demographics of the population whom the Applicant serves," along with supporting documents, funding priorities, and any prior poor performance.

If the applicant leaves unchecked the box accepting less than the full amount, Cal OES may not offer a partial award. Proposals are subject to the California Public Records Act, and the RFP says to leave out personal or private information, so you should describe weaknesses at the level the form asks for, without detail you wouldn't want released. Applicants not selected receive their average score and can appeal.

Cal OES sent allocation letters on May 22, 2026 (GMM 2026-13). On May 28, the Governor's Office announced $80 million for 343 nonprofits, 228 of them faith-based: $76 million for the nonprofits and $4 million for program administration and technical assistance. The subaward period runs from March 1, 2026, to December 31, 2027.

The 2026-27 round

According to the Legislative Analyst's Office, the 2026-27 budget funds the program at $80 million on an ongoing basis, where earlier funding was one-time or limited-term. As of October 14, 2026, Cal OES had posted no 2026-27 RFP and no date. Its last four RFPs appeared on August 30, 2022, August 17, 2023, July 30, 2024, and October 31, 2025 (announcement list), and the latest window ran six weeks. Past release dates don't set the next one.

The Governor signed AB 1836 on September 25, 2026 (Governor's Office). The chaptered text amends Government Code section 8588.9 so grant money can pay for security at onsite or offsite events a nonprofit hosts, including a nonprofit without a physical site, with offsite-event security capped at $25,000 of an award. It also bars Cal OES from setting dollar or percentage limits on individual security enhancements beyond those the statute states, such as the 5% M&A and $100,000 construction caps. We could not confirm when it takes effect or how the next RFP will treat limits such as the 2025-26 round's 50% cap on contracted security.

You can gather ownership or lease proof, landlord letters, site maps, and consistent state registrations now. Forms change between rounds, so fill in only the versions the next RFP names.

After an award: Cal OES rules for each program

Federal requirements are in the post-award guide. The federal column comes from Cal OES's FY2025 California Supplement (October 2026), the newest posted, so FY2026 terms may differ. The state column comes from the FY2025 CSNSGP State Guidance (July 2026).

The supplement lists 139 FY2025 subawards in California totaling $23,497,706: $5,177,500 for NSGP-S and $18,320,206 for the urban areas. None is above $190,000, which is $10,000 under the per-site request limit, so plan the working budget from the award letter, not the IJ.

A house of worship without an IRS determination letter should ask its Grants Analyst which document to submit under either program. You should also take dated photos of every work area before installation starts, because a "before" photo can't be retaken. Reimbursement requests covers what a claim needs.

Using both programs at one site

We found nothing in the CSNSGP RFP or Cal OES's FY2026 NSGP materials that bars an organization from seeking both. What the rules bar is paying for the same thing twice. The CSNSGP worksheet may list only vulnerabilities "not being addressed by any other funding received," and the guidance for each program treats supplanting as grounds for disallowance. If a site's doors already have federal funding, a CSNSGP proposal there should address different vulnerabilities, and the assessment should show which award covers what.

Performance carries across awards too. The RFP says Cal OES reviews compliance on projects it funded before, including fiscal management and reports, and may decide not to select the project, reduce the funding, or add special conditions.

Other programs we checked

We found no California state security grant written for private or religious schools. A school organized as a 501(c)(3) nonprofit can apply to NSGP, and to CSNSGP if it is at high risk for violent attacks and hate crimes; private and religious schools covers the school-specific rules. Cal OES's grants page still lists the California Health Center Security Grant Program and the School Communications Interoperability Grant Program, but only with FY2019 documents, and we found no current round of either.

Our check turned up no county or city security grant for nonprofits in California. We didn't survey every local budget, so ask your city or county emergency management office. Faith-specific questions are covered in the guides for churches, synagogues and Jewish communal organizations, and mosques and Islamic centers. Other states are on security grants by state, and each state's latest NSGP deadline is on NSGP deadlines.

Cal OES documents to read first

These are the documents Cal OES had posted on October 14, 2026. If Cal OES issues a newer version, the newer one controls.

Last checked and change log

Last checked: October 14, 2026, against the Cal OES documents and pages listed here, the Governor's Office releases of May 28 and September 25, 2026, the chaptered text of AB 1836 (read October 15, 2026), the Legislative Analyst's Office report of October 2, 2026, and FEMA's FY2026 NOFO, Information Bulletin 579, and NSGP page.

• October 2026: Page published. FY2026 NSGP closed (Cal OES deadline July 10, 2026); FEMA announced FY2026 awards September 28, 2026; CSNSGP 2025-26 awards announced May 28, 2026; no 2026-27 CSNSGP RFP posted.