NSGP procurement rules: quotes, thresholds and conflicts

Which procurement rules apply to an NSGP subrecipient

The FY2026 NSGP notice of funding opportunity (NOFO) applies 2 CFR 200.317–200.327 to purchases made with award funds (p. 49). A nonprofit must have and use documented procedures that reflect applicable state and local law and conform to 2 CFR 200.318–200.327. If its policy, state law, State Administrative Agency (SAA) instructions or subaward is stricter than the federal minimum, the stricter rule controls. FEMA's Preparedness Grants Manual states that following the most restrictive applicable rule satisfies every level.

These standards cover every contract and purchase order paid with NSGP funds, including guards and trainers. Procurement follows the subaward. If the subaward and SAA permit, solicitation and evaluation may proceed while required environmental review is pending, but reviewed work cannot start before written clearance. See the post-award process.

The written policies you need before the first purchase

Every nonprofit subrecipient needs documented procurement procedures and written conflict-of-interest standards before it buys with award funds:

• Documented procurement procedures (2 CFR 200.318(a)). They must make every solicitation describe the requirement clearly and name every requirement and evaluation factor bidders will face (2 CFR 200.319(d)).
• Written standards of conduct covering conflicts of interest and gifts for anyone who selects, awards or administers contracts, with disciplinary actions for violations (2 CFR 200.318(c)(1)).
• Organizational conflict-of-interest standards, if the nonprofit has a parent, affiliate or subsidiary that isn't a government, such as a separately incorporated school or foundation tied to a congregation (2 CFR 200.318(c)(2)).

FEMA's Procurement Under Grants Policy Guide (PUGPG) also calls for contractor oversight, responsibility determinations, exclusion checks, and a process for protests and disputes. The policy must match how the nonprofit actually buys.

Do you need three quotes?

The federal minimum depends on the procurement method and purchase size (2 CFR 200.320). The current thresholds took effect October 1, 2025 (FY2026 NOFO, p. 50).

Three quotes are FEMA's recommendation, not a universal federal rule. The PUGPG says a nonprofit may decide what number is adequate and encourages at least three quotes for a simplified acquisition. FEMA's nonprofit fact sheet warns that a state or local rule may set a number. For a simplified acquisition, request quotes from at least three qualified sources in writing and retain requests that receive no response.

An estimate used in an application budget does not award a contract to the firm that supplied it. The nonprofit must still conduct the procurement required by its written procedures, subaward and applicable law.

Which threshold applies to your purchase

Use the lowest applicable threshold. A nonprofit's simplified acquisition threshold may be below the federal amount but may not exceed it (2 CFR 200.1). Check the nonprofit's procedures, state and local law, the subaward, and SAA instructions. The $15,000 and $350,000 federal thresholds apply to procurements executed on or after October 1, 2025, under any open award (FY2026 NOFO, p. 50).

Measure the full requirement, not each invoice. A nonprofit may not divide a known purchase to stay below a threshold or add the rest later by change order (PUGPG, chapter 5). Separate procurements for distinct trades can be legitimate when economical under 2 CFR 200.318(d), but the file should explain the decision.

Sole source and single-bid purchases

Beyond micro-purchases, 2 CFR 200.320(c) permits a noncompetitive purchase only when the item is available from one source, an emergency will not allow time to compete, FEMA or the SAA gives written approval after a request, or competition is inadequate after solicitation. The file needs the justification, and all other contract requirements still apply.

A familiar vendor or existing service agreement is not a sole source. One response also does not establish the exception when the solicitation was too narrow or poorly publicized. Before awarding, document the outreach, consider re-soliciting, and obtain any approval the SAA requires. Adding grant work outside an existing contract's competed scope is a new noncompetitive procurement (PUGPG, chapter 5).

Can the vendor who helped plan the project still bid?

A contractor that drafted specifications, requirements, a statement of work or a solicitation may not compete for that procurement (2 CFR 200.319(b)). The FY2026 NOFO extends the restriction to contractors that help develop a grant application, project plan or budget, and to former employees who did that work (p. 51). Additional quotes do not cure the conflict. If the drafter receives the contract, FEMA may disallow the cost under 2 CFR 200.339.

Published spec sheets, test reports, prices and a requested estimate for customer-selected items are ordinary product information, which the NOFO does not name. The security vendor guide explains the boundary. When a vendor's assessment or language influenced the application, project plan, budget or solicitation, give the facts to the SAA before soliciting. The nonprofit must disclose a potential organizational conflict to FEMA or the SAA in writing (NOFO, p. 51).

Conflicts of interest and gifts

An employee, officer, board member or agent with a real or apparent conflict may not select, award or administer a contract (2 CFR 200.318(c)(1); PUGPG, chapter 3). The rule covers interests or benefits involving that person, immediate family, a partner or an affiliated organization. A related firm is not automatically barred under the federal rule, but the conflicted person must recuse, the file should record that recusal, and a stricter policy or state rule may control.

Officers, employees and agents may not solicit or accept gratuities, favors or anything of monetary value from a contractor or subcontractor (FY2026 NOFO, p. 51). Written standards may address unsolicited items of nominal value. They must also state the discipline for violations. A federal criminal-law violation involving fraud, bribery or gratuities that could affect the award must be disclosed in writing (p. 53).

Writing a request that allows competition

Describe the required performance, not one manufacturer's product. The NOFO identifies a brand-only specification that does not allow an equal as a restrictive practice (p. 50). When a performance description is impractical, 2 CFR 200.319(d) permits "brand name or equivalent" if the solicitation states the features an equal must meet.

Copying one vendor's spec sheet can restrict competition and make that vendor the drafter. Set the requirements and evaluation factors before issuing the request. For cameras, recorders and network gear, include the prohibition on covered equipment in 2 CFR 200.216. The allowable-cost guide covers that equipment rule.

Checks before you sign

Responsibility and exclusion

Award only to a contractor able to perform, considering integrity, public-policy compliance, past performance, and financial and technical resources (2 CFR 200.318(h)). Record that determination. Federal funds cannot go to a suspended or debarred party (2 CFR 200.214). For a covered transaction, including a contract expected to reach $25,000, verify exclusion status through SAM.gov, a certification or a contract clause, and keep the result (2 CFR 180.220; 2 CFR 180.300). A vendor need not register in SAM.gov, but it cannot have an active exclusion.

Small, minority, women-owned and veteran-owned firms

The text of 2 CFR 200.321 says recipients and subrecipients should consider these firms when possible. FEMA's July 2025 PUGPG says the outreach steps are no longer required by the federal procurement rules. A state or subaward may still require or document outreach, so check the current terms.

Contract clauses and state review

Include every applicable provision under 2 CFR 200.327 and Appendix II to Part 200. Termination provisions apply above $10,000, while the anti-lobbying certification applies above $100,000. FEMA's Procurement Under Grants resource library provides a Contract Provisions Guide. An SAA may require pre-award review under 2 CFR 200.325. Follow the subaward and the SAA's written direction before placing an order or paying a deposit. Do not begin installation until any required environmental planning and historic preservation (EHP) review is cleared.

Contracted security guards

A guard contract is a services procurement. The FY2026 NOFO permits a subrecipient to use up to 100% of its award for contracted security, requires compliance with Information Bulletin 441, and bars equipment purchases for contracted security (Appendix A). Apply the procurement threshold to the contract's full value, not a monthly invoice.

An existing guard agreement may be charged to the grant only if the procurement meets the applicable standards; moving an agreement that was not competed onto the award is noncompetitive. Keep the company and officer licenses required by state law or the SAA. FDEM's FY2024 guide says contract security "must be competitively procured" and that sole source for it "is not allowable." The security guard guide covers application and claim records.

What to keep in the procurement file

2 CFR 200.318(i) requires records sufficient to show the procurement's history: the method, contract type, contractor selection or rejection, and price basis. The NOFO also names specifications, solicitations, quotes or proposals, purchase orders, contracts, invoices and cancelled checks (pp. 53–54). For each purchase, retain:

• the estimate or market research, including the reason a micro-purchase price was reasonable;
• the solicitation, firms contacted and every response received;
• the evaluation, selection decision, responsibility determination and exclusion check;
• conflict disclosures, recusals, and any noncompetitive justification and SAA approval;
• the contract or purchase order, federal clauses and change orders; and
• delivery or performance records, invoices and proof of payment.

The general retention period is at least three years from the applicable final financial report, with longer periods in specified circumstances (FY2026 NOFO, p. 53). Confirm with the SAA which report starts the clock. FEMA, auditors and the SAA may inspect the records. See the separate guidance on reimbursement claims and monitoring visits.