What the IJ is
The IJ is part of the package each nonprofit sends its State Administrative Agency (SAA), along with a site-specific vulnerability assessment and a mission statement (FEMA, FY2026 NSGP NOFO, p. 27). It is the request itself: what you want to buy or do, which risk each item answers, what it costs, and when it will happen. Each IJ covers one site. A nonprofit applying for several sites submits a separate, complete IJ for each, and "IJs cannot include more than one physical site" (p. 27).
Under the FY2026 notice of funding opportunity (NOFO), the projects in an IJ must be at a location the nonprofit occupies at the time of application, not a P.O. box. They must address an identified threat and vulnerability, be feasible and effective, finish within the three-year period of performance, and follow the NOFO and FEMA's Preparedness Grants Manual (p. 27).
Who reads it, and in what order
The State Administrative Agency (SAA) checks eligibility and completeness, scores each IJ under FEMA's 40-point Appendix D matrix, validates the organization type against the mission statement, and ranks the IJs (pp. 32–35). The SAA sends FEMA every IJ, including those it does not recommend (p. 26), while retaining the vulnerability assessments and mission statements for FEMA upon request (p. 28).
FEMA applies the organization-type multiplier and first-time bonus. It conducts the federal review of applications the SAA recommends, checking program compliance, feasibility, effectiveness, and allowable projects. After competitive scoring and selection, the Department of Homeland Security separately checks each potential subrecipient's name and physical address against intelligence reporting (pp. 30–35). FEMA's IJ checklist directs applicants to make the IJ self-contained for federal review, and its writing tips say not to refer to "supporting documentation" in place of an answer. Tennessee's SAA treats "see attached" in a field as an incomplete IJ (FY26 instructions).
The FY2026 form
The NOFO identifies the form as "DHS/FEMA Form FF-207-FY-21-115, OMB Control Number: 1660-0110" (p. 27). Check the footer's revision date as well as the form number. FEMA posted June and July 2026 revisions; the later file on Grants.gov is marked "(07/26)" and added video analytics to the equipment dropdown and "NSS" to the funding history choices. California's SAA specified the June version in its FY2026 webinar. Use the revision your SAA requires, and ask the agency how to handle an item missing from that revision.
The file is a dynamic fillable form. An incompatible viewer shows only a "Please wait..." page. Open the saved form in a compatible desktop PDF reader, keep it fillable, and do not scan it. Cal OES gave FY2026 applicants the same instruction to save the file to their computer before opening it.
What each part asks for
Seven parts make up the FY2026 form, plus a funding history and a contact section. The point values printed on the form match the NOFO's Appendix D matrix, which totals 40. Character limits come from the form file.
| Part | What the form asks for | Points | Space |
|---|---|---|---|
| I. Applicant information | Legal name; the facility's physical address and county; whether you own or lease, and the owner's permission if you lease; whether you occupy the site now; whether other nonprofits operate there; a mission summary; organization type, function, and affiliation; 501(c)(3) status; Unique Entity ID (UEI); urban area; total request, filled in from Section IV-B | 0 (checked yes/no for completeness) | Mission summary 400 characters |
| II. Background | The site's symbolic value; recent events (last three years) in which the organization took part in prevention, protection, response, or recovery, and its role, including how it works with state and local preparedness | 5 | 500 characters per answer |
| III. Risk | A) threats, B) vulnerabilities, C) potential consequences | 15 | 2,200 characters each |
| IV. Facility hardening | IV-A: a narrative of each activity, the vulnerability it addresses, quantity, unit price or hourly rate, use, and cost. IV-B: up to 10 lines, each with an Authorized Equipment List (AEL) code or cost category, the vulnerability addressed, and an estimate rounded to the dollar | 9 | IV-A 2,200 characters |
| V. Milestones | Key activities and milestones with start and completion dates. Line 1 is fixed: environmental and historic preservation (EHP) review | 5 | 10 lines |
| VI. Project management | Who manages the project (name, phone, email, experience); the management plan, its challenges, and coordination with state and local homeland security partners | 2 | 1,000 characters each |
| VII. Impact | Measurable outputs and outcomes that will show the investment succeeded by the end of the period of performance | 4 | 2,200 characters |
| Funding history | Prior federal NSGP awards only: year, amount, and project. State-funded NSGP awards and other federal awards are excluded | Not scored; sets the 15-point bonus | Open field |
| Contact and certification | The preparer's and nonprofit representative's contact details, their relationship to the nonprofit, who wrote the application, and the required certification | Not scored | Short fields |
An outside writer may prepare the application where the state allows, and the FY2026 form lets the nonprofit identify someone it hired to apply on its behalf. The Authorized Organization Representative (AOR) who signs and certifies must still be the nonprofit's own current officer or employee, not a consultant or contractor (FY2026 NOFO, p. 7).
How the SAA scores each question
SAA reviewers "score each question in the IJ according to the scoring matrix in Appendix D" (p. 35). FEMA's FY2026 scoring tool for SAAs, posted on Grants.gov, numbers the questions 1 to 13. Question 1 is the yes-or-no completeness check for Part I; the other 12 carry 40 points. The full matrix appears at pp. 69–77 of the NOFO.
| Part | Question, in brief | Points | What the matrix looks for |
|---|---|---|---|
| II | Symbolic value of the site | 0–3 | The organization, its mission, the symbolic value of the building or organization, and how those factors may make it a target. Top score: "a full, clear, and effective description" |
| II | Role in response or recovery | 0–2 | A previous or existing role in response to or recovery from attacks, tied to state or local preparedness efforts |
| III | Threats | 0–5 | Incidents at or threats to the organization, or to closely related organizations at home or abroad. Top score: "multiple, detailed, and specific threats or attacks" |
| III | Vulnerabilities | 0–5 | "[A] clear description of findings from a completed vulnerability assessment" |
| III | Consequences | 0–5 | Effects of an attack on the organization, the community it serves, and, where applicable, areas beyond that community (nearby critical infrastructure, businesses, transportation, and schools) |
| IV | Projects described and related to the risk | 0–3 | What each item is, its estimated cost, and how it mitigates vulnerabilities in the assessment. Top score: "clearly aligned with and effectively mitigate" |
| IV | Focus on terrorism and extremism | 0–3 | Items tied directly to preventing or protecting against "the risk of terrorist or other extremist attacks" |
| IV | Each item tied to a vulnerability | 0–3 | Each item mitigates "the vulnerability tied to it." Zero if "[n]o vulnerabilities are listed" |
| V | Milestones described | 0–3 | The milestones and the key activities needed to reach them |
| V | Milestones feasible | 0–2 | Realistic, across the 36-month period, covering all proposed activities, with EHP review considered |
| VI | Project management | 0–2 | "Brief description of the project manager(s) and level of experience" |
| VII | Outcomes and outputs | 0–4 | Measurable results that "directly link to the vulnerabilities and consequences outlined in the 'Risk' Section" |
The threat criterion permits incidents at similar organizations if "the subapplicant [makes] the connection that they are at risk for the same reasons." Local burglary, theft, or vandalism without a terrorism, extremism, or hate-related link provides context but does not establish the risk this criterion scores (pp. 71–72). Tennessee's SAA also requires applicants to connect past events and threats elsewhere to the "here and now" risk at their location.
The milestone questions expect a schedule that covers "the entire period of performance (36 months)," includes "all proposed activities," and considers EHP review. The matrix adds that milestones "should not exceed 36 months and should not begin prior to the Period of Performance" (p. 76). For FY2026, the NOFO projected that period as September 1, 2026, to August 31, 2029 (p. 4). The form fixes the first milestone line as "Environmental Planning and Historical Preservation review" and locks it, and the EHP review guide explains why that step takes time.
Ranking also reflects the SAA's own expertise and discretion, with two named factors: need, compared with other subapplicants, and impact, meaning the project's feasibility and how well it addresses that need (pp. 33, 35).
From the state score to the final score
FEMA calculates the final score as "SAA Score * Multiplier + Bonus Points" (p. 35). The multiplier comes from the organization type selected in Part I (p. 31):
- ×3 for "ideology-based/spiritual/religious entities (Houses of Worship, Educational Institutions, Medical Facilities, etc.)";
- ×2 for secular medical and educational institutions;
- ×1 for all other nonprofits.
FEMA adds 15 points after the multiplier for a subapplicant that has never received an NSGP award (p. 31). Its FY2026 key changes sheet states that no other bonus points apply. Do not use older scoring instructions: FDEM's April 2024 tips, for example, describe bonus points that did not carry into FY2026.
A hypothetical example shows the arithmetic. Two applicants in the same state each receive 30 of 40 points from the SAA. A house of worship that has never received an NSGP award finishes at 105 (30 × 3 + 15), while a secular community center with a prior award finishes at 30.
Because the type drives the multiplier, the SAA checks it. It validates the self-identified type "by assessing the central purpose of the organization described in the mission statement" (p. 33). A type the mission statement does not support, or a funding history that omits a prior NSGP award or includes other grants, can change the final score. The form also states, "There is NO scoring preference given to certain affiliations or lack thereof."
Applications compete only within their own state or territory, and NSGP Urban Area (NSGP-UA) applications within their urban area. Selection runs from the highest final score down until the allocation is spent. Ties go first to organizations without prior funding, then to the SAA's ranking, and the Secretary of Homeland Security makes the final funding determinations (p. 35). Eligibility, the urban area list, and the multipliers are covered in the NSGP program guide.
Consistency checks before you submit
Trace each budget line to the site risk, assessment finding, and project description. Then check the form against the matrix and your SAA's instructions:
- The totals agree. The IV-A narrative, IV-B lines, and total request must show the same numbers.
- Names and addresses match. New York's Division of Homeland Security and Emergency Services (DHSES) requires the IJ's physical address to exactly match the vulnerability assessment and the organization's full legal name to be consistent across documents (DHSES checklist).
- Every line has a finding. Each IV-B line names the vulnerability it addresses, that vulnerability appears in Part III, and the assessment documents it. IV-A explains every IV-B cost so the SAA and FEMA can validate the need.
- Costs are all-in. The NOFO asks that budget narratives "indicate costs that include shipping and/or tax, as applicable" (p. 64). Estimates are rounded to the nearest dollar.
- Guards and training carry detail. FDEM asks for hourly or daily rates, number of personnel, and anticipated hours or days for contracted security, and named courses, agendas, and audiences for training. NSGP-funded training must address a specific threat or vulnerability identified in the IJ, and all its costs must appear there (p. 66). See security guard grants.
- Milestones fit the period. Dates fall inside the period of performance, cover every proposed activity, and follow a workable order from quotes to installation to reimbursement.
- Every line is allowable. An AEL code does not by itself make a project allowable or fundable. Check each line against the current NOFO and the allowable costs guide.
- The site facts hold. The form asks whether you own or lease, whether the owner approved the work, whether you occupy the site now, and whether other nonprofits operate there. Only one nonprofit may apply per building, facility, physical structure, or address. The form warns that multiple requests from the same address "will all be deemed ineligible."
- Nothing is left blank. FEMA's checklist requires every question in every section to be answered for the IJ to count as complete, and its writing tips note that an "other" choice in a dropdown needs its description filled in.
Have someone other than the writer check the final file for mismatched totals, unsupported line items, and stale answers. If the reviewer is outside the organization, the nonprofit's AOR still owns the certification.
Form and file errors
The NOFO disqualifies incomplete packages and applications that are "administratively noncompliant (e.g., scanned IJs, incorrect or previous year forms)" (p. 30). State instructions add file-specific rules:
- New York requires the IJ in "its original fillable PDF format with all fillable fields and drop-downs active/enabled," and any other format is excluded from funding consideration (DHSES checklist).
- Tennessee treats any change to the form's formatting as an automatic disqualifier (FY26 instructions).
- Indiana tells applicants not to convert the form, add pages, or scan it (FY2026 instructions).
- The form prescribes file names: "FY2026_NSGP_UA_<State Abbreviation>_<Urban Area>_<Nonprofit Name>" for urban area applicants and "FY2026_NSGP_S_<State Abbreviation>_<Nonprofit Name>" for state applicants. States can add their own rules.
Before submission, reopen the saved file in the desktop reader and confirm that every section displays, every dropdown works, and the totals carried through.
Once the IJ is final, it goes to the SAA with the assessment and mission statement by the state's deadline, which comes before FEMA's; the application steps and deadlines page cover that sequence. If a past application was not selected, NSGP application mistakes explains the difference between ineligible, incomplete, and not selected.
Frequently asked questions
Can we correct our IJ after we submit it?
That depends on your SAA. For FY2026, Cal OES said resubmitted or duplicate applications would not be considered (FY2026 webinar). The NOFO requires an SAA whose deadline fell before the notice's release to work with nonprofits that need to amend their submissions (p. 30). Otherwise, ask your SAA in writing, before its deadline, whether it accepts a corrected file and how to label it.
Sources
- FEMA, FY2026 Nonprofit Security Grant Program NOFO
- Grants.gov, FY2026 NSGP posting: Investment Justification form (FEMA Form FF-207-FY-21-115, rev. 07/26) and SAA scoring tool
- FEMA, NSGP Investment Justification Checklist
- FEMA, NSGP Grant Writing Tips
- FEMA, FY2026 NSGP Key Changes
- FEMA, Preparedness Grants Manual
- Cal OES, FY2026 NSGP Application Webinar
- New York DHSES, FY2026 NSGP Application Checklist
- Tennessee Department of Safety and Homeland Security, FY26 NSGP Instructions and FAQs
- Indiana Department of Homeland Security, FY2026 NSGP-S Application Instructions
- FDEM, Completing the Investment Justification tips (rev. April 2024)