How to bid on an NSGP or FEMA-funded security project

Identify the buyer before you bid

The buyer's identity matters. A nonprofit NSGP subrecipient, a public school district and a local government may all receive federal security funding but follow different procurement rules. Do not choose a bidding method from the funding source alone. Identify the buyer, the award, the pass-through agency and the applicable state or local rules first. The vendor requirements page has a table of buyer types and the rules that usually govern each.

For a nonprofit, the pass-through agency is the State Administrative Agency (SAA) that made its subaward. The nonprofit must follow its own written procedures, 2 CFR 200.318 to 200.327 and any stricter state or SAA rule. That stricter rule is often the one you will meet in the request.

How purchase size shapes the competition

For nonprofit NSGP subrecipients under the FY2026 NOFO, the federal micro-purchase threshold is $15,000 and the simplified acquisition threshold is $350,000, effective October 1, 2025. Here is what each tier looks like from the vendor's side:

The self-certified limit comes from 2 CFR 200.320(a)(1)(iv), which lets a nonprofit set a threshold up to $50,000 each year with a documented basis; FEMA's nonprofit fact sheet repeats it. Whether a given SAA accepts it is a separate question. States can be much stricter. New York's DHSES requires three telephone quotes from $1,000 to $4,999, three written quotes from $5,000 to $9,999, and competitive bidding at $10,000 and above (November 2025 guidance). The NSGP procurement guide explains the nonprofit's side of each tier.

Before you compete: the planning conflict

Under 2 CFR 200.319(b), contractors that develop or draft specifications, requirements, statements of work or invitations for bids must be excluded from competing for those procurements. The FY2026 NOFO adds requests for proposals, treats the problem as an organizational conflict of interest, and extends it to contractors who assist in developing grant applications, project plans or budgets. It also reaches former employees of the nonprofit who did that work.

Labels do not control. Calling work a "free assessment," "budgetary quote," "consultation" or "courtesy design" does not preserve the vendor's eligibility if the work helped develop the application, project plan, budget, specifications, statement of work or solicitation. FEMA has not published a line for every case. Sort what you have done, or are asked to do, into three groups:

Agencies can read the fact-dependent cases strictly. Missouri's FY2024 compliance workshop told nonprofits that "whoever completes your risk assessment cannot participate in the bidding process" (Missouri DPS, October 2024). For what a vendor may say to a prospect before any of this, see the vendor orientation page.

Reading the request

A request for quotes from a small nonprofit may be one page, and a formal solicitation may run fifty. Either way, find these points before you price:

• the buyer's legal name, and the award and pass-through agency, if stated;
• the method (quote, sealed bid or proposal), the named contact and the question deadline;
• the scope, quantities, site conditions and whether alternates or options are allowed;
• any brand named, and whether "or equal" is accepted with the features an equal must meet;
• the evaluation basis; for proposals, the notice must list the factors and their relative importance (2 CFR 200.320(b)(2));
• required forms, certifications, licenses, insurance and any bonding;
• the federal clauses in the draft contract, and any wage determination; and
• the schedule, the price-validity period and the submission channel and deadline.

The clauses and their triggers are on the vendor requirements page. If something in the request looks unworkable or tilted toward one firm, ask in the question period. That is the right channel for it.

Contact rules during the competition

Once a request is out, every firm should get the same information. Missouri's workshop states it plainly: "The same information must be provided to all interested parties." State buyers may go further; Florida state solicitations bar contact outside the named channel from release until 72 hours after the notice of intended award (s. 287.057). Follow each request's own rules, and as a baseline:

• Use the named contact. Do not lobby board members, staff, evaluators or the nonprofit's consultants privately.
• Ask questions inside the stated period, in writing.
• Rely only on written addenda. An oral answer does not change the request.
• Do not offer to help rewrite requirements while the competition is open.
• Tell the buyer about any relationship that could look like a conflict, such as a family tie to a board member or prior planning work.
• Offer no gifts, meals, individual discounts, referral payments or favors.

The gift rule binds the buyer: its officers, employees, agents and board members may not solicit or accept anything of monetary value from contractors (2 CFR 200.318(c)(1)). FEMA's procurement guide says this covers entertainment, hospitality, meals, travel and lodging. The vendor's exposure is criminal as well. 18 U.S.C. 666 reaches anyone who corruptly gives or offers something of value to an agent of an organization receiving more than $10,000 a year in federal benefits, with penalties up to 10 years in prison.

What makes a response responsive

Each request sets its own checklist, and a missing item can disqualify a low price. FEMA's procurement guide gives the example of a low bidder rejected because it could not meet the required completion date. Information commonly requested in a quote for an NSGP project:

• every addendum acknowledged, every required form completed and signed;
• each item with manufacturer, model, quantity and unit cost; California's SAA requires this and the contractor license number (Cal OES supplement);
• the original manufacturer of every camera, recorder and network device, so the buyer can apply Section 889;
• installation shown as its own line, which maps to the NSGP installation code 21GN-00-INST (good practice, not a FEMA rule); shipping and tax included in cost, though the NOFO does not require them as separate lines;
• a proposed equipment code for each line if the buyer asks, leaving the final coding to the buyer; the allowable-cost guide lists the codes;
• no license plate reader or facial recognition software, which the NOFO does not allow, and no unallowable item bundled into an allowable line;
• base bid and options priced separately, alternates only where allowed, and every exception stated;
• warranty, maintenance and software license terms, with their dates;
• the delivery and installation schedule and the price-validity period;
• subcontractors and their roles;
• license evidence, plus insurance certificates and bonds only when the request asks for them; and
• the suspension and debarment certification, the anti-lobbying certification for bids over $100,000, and a Build America, Buy America certification only if that rule applies.

Submit through the stated channel, before the deadline. A buyer may refuse a late or misdirected response, so leave time for portal uploads.

How the buyer evaluates, from your side

The method decides the basis. Under sealed bidding, the award goes to the lowest responsive and responsible bidder at a firm fixed price. Under proposals, it goes to the responsible offeror whose proposal is most advantageous on price and the published factors. For a simplified acquisition, the rule does not set the basis, but the buyer must record why it chose the winner and how it judged the price (2 CFR 200.318(i)).

In every case the buyer must find the winner responsible, looking at integrity, compliance, past performance, and financial and technical resources (2 CFR 200.318(h)). Expect requests for references, licenses and financial information. Above $350,000, the buyer must prepare an independent estimate before receiving offers and analyze cost or price (2 CFR 200.324). Itemized pricing makes that comparison easier. A price well above the estimate may draw questions. Cost-plus-a-percentage-of-cost pricing is prohibited, and a time-and-materials contract needs a ceiling price that the contractor exceeds at its own risk.

If you think the process was unfair

Protests go to the buyer. FEMA's procurement guide says buyers should have a process for protests and disputes, and that the buyer, not FEMA, settles them (citing 2 CFR 200.318(k)). Ask for the buyer's protest procedure and deadline, put your concern in writing, and keep it factual. If you suspect fraud or bribery, FEMA's guide asks for reports to StopFEMAFraud@fema.dhs.gov.

After award: performance and invoicing

Do not order material, start work or take a deposit until the nonprofit's subaward is in place, any required environmental review is cleared and you hold a signed contract or purchase order. Subrecipients cannot claim pre-award costs, and Missouri's workshop warned that "projects started before clearance is issued will NOT be reimbursed." Do the work as contracted. A change in location, quantity or method needs the buyer's written approval, and it may need a new review.

Invoice so the nonprofit's claim can be followed line by line:

• itemize to match the contract lines, with unit cost and quantity;
• list model and serial numbers for installed equipment; the buyer's federal property records need an identification number for each item (2 CFR 200.313);
• keep grant work on its own invoices, separate from other awards and non-grant jobs at the same site;
• do not change an invoice after it has been paid; issue a credit or a new invoice; and
• for guard work, back each invoice with matching time records.

Your payment rights come from your contract with the buyer, not from FEMA. In the sources we checked, NSGP pays the nonprofit by reimbursement: Florida calls it "a COST REIMBURSEMENT grant program" (FDEM FY2024 guide), and the NOFO requires FEMA to approve reimbursement requests before funds are drawn. Federal rules require the nonprofit to pay contractors on time under the contract's terms (2 CFR 200.305(b)). Agree on payment terms, deposits and milestones in writing before you sign. Subrecipients must submit closeout materials within 90 days after the subaward period ends, so send final invoices well before then.