Why NSGP applications fail or aren't selected

Ineligible, incomplete, and not selected

The FY2026 notice of funding opportunity (NOFO) sets threshold criteria before scoring:

"Subapplicants will be disqualified if they: submit incomplete subapplication packages; are administratively noncompliant (e.g., scanned IJs, incorrect or previous year forms); have a history of poor performance in grant administration; apply for the wrong funding stream; and/or are deemed an ineligible organization."

An eligibility failure concerns the nonprofit, site, funding stream, or grant-performance history. An incomplete or noncompliant package has a missing required document or a defective form. Neither reaches the Appendix D scoring stage. The SAA scores each eligible, complete Investment Justification (IJ) under the 40-point matrix, then FEMA applies the organization-type multiplier and 15-point first-time bonus and conducts the federal review. The Secretary of Homeland Security makes the final determination (FY2026 NOFO, pp. 30–35).

An eligible, complete application can still lose on rank. FEMA funded more than 1,600 nonprofits from over 7,000 FY2026 applications, a selection rate under 23% (FEMA, September 28, 2026; Jewish Insider, September 30, 2026).

Eligibility and funding-stream errors

FEMA designates high-risk urban areas each fiscal year. SAAs, in coordination with Urban Area Working Groups or other state partners, set their footprints. Those boundaries don't always follow the city or county lines an applicant expects. The NOFO tells nonprofits to confirm the footprint with the SAA (p. 30). An application filed under NSGP Urban Area (NSGP-UA) from outside the footprint, or under NSGP State (NSGP-S) from inside it, is disqualified.

Projects must be at an address the nonprofit occupies when it applies, and each IJ covers one physical site (p. 27). The FY2026 IJ form adds a separate restriction: only one nonprofit may apply per building, facility, physical structure, or address. If multiple nonprofits submit requests for the same location, all are ineligible. A nonprofit with two campuses needs a separate IJ and vulnerability assessment for each.

An outside writer may prepare an application where the state allows, and the FY2026 IJ form recognizes that someone hired by the nonprofit may apply on its behalf. The Authorized Organization Representative who signs and certifies must be the nonprofit's own current officer or employee, not a consultant. Use an email address unique to the organization and tell the SAA if the representative changes (FY2026 NOFO, p. 7).

For organizations with earlier awards, the threshold list adds "a history of poor performance in grant administration" (p. 30), which turns on how those awards were managed. Ask the SAA whether it applied this threshold. Before preparing another IJ, check the underlying organization and funding rules in the NSGP program guide.

Registration, portal, and deadline misses

An organization without a Unique Entity ID (UEI) cannot receive a subaward (2 CFR 25.300). Start the UEI process before the state window opens, and check the SAA's notice for any additional registration requirements.

A portal-access cutoff may come first. For FY2026, the Florida Division of Emergency Management closed SharePoint access requests at 5 p.m. on Friday, July 10, 2026; applications were due at 11:59 p.m. ET on Wednesday, July 15, 2026 (FDEM FY2026 Application Guide). An organization that tracked only the application date could not submit. The application steps explain the portal sequence, and our Florida page keeps the state details.

The federal deadline did not govern nonprofits. Information Bulletin 579 moved the FY2026 deadline for SAAs from July 24 to 5 p.m. ET on July 31, 2026. Each nonprofit remained bound by its SAA's earlier date, and most state deadlines did not move. The deadlines page records each state's FY2026 cutoff.

Packages that are incomplete or noncompliant

The SAA scores an IJ only after confirming that the application package is complete, and the NOFO does not promise an opportunity to cure a missing item (p. 32). Check the SAA's current checklist. A nonprofit may need its IRS determination letter because the NOFO lets each state decide whether to require proof of exemption from organizations that the IRS requires to seek recognition (p. 6). Every FY2026 applicant also needed short bios and resumes for its leadership and board members, with names and addresses (p. 7).

Form problems disqualify on their own. The threshold criteria name "scanned IJs, incorrect or previous year forms" (p. 30). Reusing last year's file creates the same failure, while a web browser may break fields that the form's required desktop PDF reader displays correctly. FEMA's IJ checklist requires an answer to every question for the IJ to count as complete. FEMA's grant writing tips add that choosing "other" in a dropdown requires a description in the follow-up field.

Each site needs a unique assessment, and the NOFO warns that failing to provide one "may result in the rejection of the application" (p. 7). Some SAAs add format rules. Florida, for example, required the organization's name and physical address to appear on the assessment; its other package rules are on our Florida page.

Errors that cost points

An application can clear every threshold and still rank too low. The SAA scores each IJ question against the NOFO's Appendix D matrix, and the risk section carries the most weight: the questions on threats, vulnerabilities, and consequences are each worth up to 5 points, more than any other question (pp. 71–74). The matrix says local crimes "without a terrorism, extremism, or hate-related nexus" may provide context; they do not substitute for threats or attacks linked to that nexus (p. 72). The top score on the threats question goes to "multiple, detailed, and specific threats or attacks" against the organization or a closely related one, tied to a clear reason the site faces the same risk.

Projects have to trace back to the assessment. The facility hardening questions ask whether each item is tied to a vulnerability it could reasonably address (p. 75). Starting with a vendor's product list or an internal wish list breaks that trace and costs points. An item with no matching weakness may not be funded.

Guard and training requests need enough detail to evaluate. Florida's IJ guidance asks guard applicants for hours, rates, number of officers, frequency, and a plan to sustain the cost. The NOFO requires each training course and its costs to appear in the IJ and address a specific threat or vulnerability (p. 66). Our page on contracted security covers guard requests in more depth.

Milestones are scored for both description and feasibility (pp. 75–76). Schedules lose points when they bunch work into the first months, omit environmental and historic preservation (EHP) review, or start before the period of performance. FEMA's writing tips call for a practical timeline within the performance period.

Totals also need a final reconciliation. Florida requires the narrative total, equipment-list total, federal request, and total project cost to match. A late edit to one section can break the arithmetic.

Organization type and funding history change the final score. The SAA validates the selected type against the mission statement, then FEMA multiplies the SAA score by three for ideology-based, spiritual, or religious entities (including houses of worship and educational institutions), by two for secular medical and educational institutions, and by one for other nonprofits. FEMA adds 15 points if the organization has never received an NSGP award (pp. 31–34). Funding history means prior NSGP awards through FEMA, according to FEMA's IJ checklist.

Unallowable items in the request

FEMA reviews each IJ for unallowable expenses and projects, with costs "disallowed or placed on hold as necessary" (p. 32). Common errors include license plate readers, facial recognition software, equipment for contracted guards, general-use items, and covered telecommunications or drone products (pp. 17–18, 59, 67). Check each line against the current year's list in our allowable costs guide.

What to do after a decision

The SAA delivers the decision and must notify organizations that weren't selected no later than 90 days after accepting its own award (NOFO, p. 38). The FY2026 NOFO doesn't require the SAA to share scores or reviewer comments, and it describes no appeal process for subapplicants. Ask in writing for the outcome category, score, and any comments, then keep the reply with the application file.

Ruled ineligible

Identify the rule that failed. A stream or site problem is fixed by applying next cycle in the right stream or for an address the nonprofit occupies. If the SAA appears to have misread a fact such as the address or tax-exempt status, respond in writing with the supporting document.

Incomplete or noncompliant

Rebuild the package before the next notice. Gather the mission statement, bios and resumes, proof of tax-exempt status where the state requires it, and a current assessment. Download the next cycle's IJ form fresh, then submit early enough to confirm that every file opens and is final.

Eligible but not selected

The application met the rules and lost on rank. Ask where it fell, then rework the parts the public scoring matrix rewards: specific threats, a vulnerability description drawn from the assessment, items that trace to it, and a feasible schedule. Start a new IJ on the next year's form; don't edit the old file. The Investment Justification guide walks through each section.

Post-award errors are separate. See the guides to EHP review, procurement, reimbursement claims, and monitoring visits, or start with the full post-award sequence.