How to apply for the Nonprofit Security Grant Program

Who applies, and to whom

FEMA publishes the annual notice of funding opportunity (NOFO) and conducts the federal review. Each State Administrative Agency (SAA) is the formal applicant: it sets the state deadline, collects nonprofit applications, scores their IJs, and submits the state's package to FEMA. The nonprofit is a subapplicant, and becomes the SAA's subrecipient if selected. The FY2026 NOFO says nonprofits "may NOT apply directly" to FEMA (p. 5).

Confirm the nonprofit's eligibility before building its package. Our NSGP program guide covers the organization, risk, tax status, funding limits, and scoring rules.

Use the site's physical location to identify the SAA, as directed by FEMA's application checklist. FEMA publishes SAA contacts, and our state-by-state table links each agency's NSGP page.

The application, step by step

Start the Unique Entity ID process before the state window opens, and request portal access as soon as the SAA permits. Some SAAs close access before the application deadline.

1. Confirm the funding stream and sites.Review the FY2026 designated urban areas in Appendix B of the NOFO, then ask the SAA to confirm whether each street address falls within the locally defined footprint. A site inside that footprint applies under NSGP Urban Area (NSGP-UA); a site outside it applies under NSGP State (NSGP-S). An application in the wrong stream is disqualified (p. 30). Each IJ covers one physical address that the organization occupies when it applies; a P.O. box is not a project location. The FY2026 IJ form also allows only one nonprofit applicant per building, facility, physical structure, or address; multiple requests from the same location are all ineligible. A nonprofit may request up to $200,000 per site and three sites per funding stream, without exceeding $600,000 total per organization per state (NOFO, pp. 7, 27).
2. Get a Unique Entity ID.The SAA cannot issue a subaward to an organization without a Unique Entity ID (UEI) from SAM.gov. A subrecipient may obtain one without completing full SAM.gov registration under 2 CFR 25.300, though an SAA may impose additional registration requirements. You'll need a login.gov account. The Grants.gov and FEMA GO registrations in the NOFO apply to the SAA, which submits in FEMA GO (p. 26).
3. Get a vulnerability assessment for each site.Each IJ needs an assessment specific to its address, even when several sites request similar projects. The NOFO warns that failing to provide a unique assessment for each site "may result in the rejection of the application" (p. 7), and its cost is unallowable under NSGP (p. 17). The vulnerability assessment guide covers timing, assessors, and required content.
4. Choose projects that answer the assessment, and code them.Allowable NSGP costs fall into planning, equipment, training, exercises, and contracted security (pp. 6, 67). Equipment is limited to the items Appendix A lists by Authorized Equipment List (AEL) code and must be installed on property the nonprofit owns or leases (pp. 58–59). Start with the weaknesses named in the assessment and select projects that address them. The scoring matrix asks whether each proposed item is "tied to a vulnerability" it could reasonably address (p. 75). Our allowable costs guide lists the FY2026 codes and exclusions.
5. Document the basis for each cost.The IJ budget uses estimates rounded to the dollar, according to FEMA's IJ checklist, and the NOFO asks budget narratives to include shipping and tax where they apply (p. 64). Each line should rest on a written estimate or published price, so the SAA can check it. Ask vendors for product documentation and itemized estimates. A vendor that helps develop the grant application, project plan, or budget cannot compete for the resulting purchase under the FY2026 NOFO (p. 51); our guide for vendors explains the conflict rule. An estimate does not replace the competitive purchase required after an award.
6. Complete the Investment Justification.Use FEMA Form FF-207-FY-21-115 from the current Grants.gov posting or the SAA. Complete it in the desktop PDF reader specified by the form; browsers and basic viewers may not display its fields. FEMA's checklist requires an answer to every question. The Investment Justification guide covers the sections, technical form traps, milestones, and scoring matrix.
7. Assemble the rest of the state's package.FEMA requires an IJ and an assessment for each site, plus the organization's mission statement and any mission implementation policies or practices that may raise its risk (pp. 27–28). The SAA uses the mission statement to check the organization type you choose in the IJ, and that type sets your score multiplier. The FY2026 NOFO also requires short bios and resumes that identify the entity type and list organizational leadership and board members, including the individuals' names and addresses (p. 7). FEMA's checklist warns that the SAA's list "might include more documents than FEMA requires."
8. Complete any state registration or portal step.Some SAAs require a notice of intent, portal registration, or access request before the application deadline. Request access when the state window opens, then watch the inbox and spam folder for the invitation. The NSGP deadlines page identifies these separate cutoffs, and our Florida guide explains FDEM's two-step SharePoint process.
9. Submit through the SAA's required channel.FEMA's how-to-apply page says the SAA deadline is earlier than the federal deadline because the state must review packages, score the IJs, and rank applications first. Information Bulletin 579 moved the FY2026 deadline for SAAs from July 24 to 5 p.m. ET on July 31, 2026. It did not automatically extend nonprofit deadlines, and most state dates did not move. Follow the SAA's instructions for email or portal delivery, and keep the confirmation.

Documents to expect, federal and state

FEMA requires the IJ, vulnerability assessment, and mission statement, while the NOFO separately requires leadership and board bios and resumes. Build the package from the SAA's current guide; another state's checklist or a prior year's list does not control.

The NOFO disqualifies an incomplete package at threshold; it does not deduct points (p. 30). Our guide to application mistakes explains the difference between incomplete, ineligible, and eligible but not selected.

What happens after you submit

The SAA checks eligibility and funding-stream placement and confirms that the package is complete, then scores the IJ under the 40-point Appendix D matrix. It validates the organization type against the mission statement and ranks each application, with separate rankings for each urban area. The SAA submits all IJs and its prioritization tracker to FEMA; the IJs recommended for funding should total 150% of the applicable allocation so another application is available if FEMA finds an eligibility or allowability problem (FY2026 NOFO, pp. 26, 32–34).

FEMA conducts the federal eligibility and allowability review of recommended applications. It multiplies the SAA score by three for ideology-based, spiritual, or religious entities (including houses of worship and educational institutions), by two for secular medical and educational institutions, and by one for other nonprofits, then adds 15 points for an organization that has never received an NSGP award. After competitive scoring and selection, DHS separately reviews each potential subrecipient's name and physical address against intelligence reporting. The Secretary of Homeland Security makes the final funding determination (pp. 31–35). Our program guide explains the scoring and funding limits.

The SAA sends the nonprofit's decision. It must notify organizations that weren't selected no later than 90 days after accepting its own FEMA award (NOFO, p. 38).

If selected, wait for the SAA's subaward agreement and required approvals before committing costs. Subrecipients cannot claim pre-award costs (NOFO, p. 19). After the award covers acceptance, environmental review, procurement, reimbursement, reporting, and closeout.