The NSGP vulnerability assessment

Why the application depends on it

The FY2026 notice of funding opportunity (NOFO) requires an Investment Justification (IJ), a mission statement, and "a site-specific vulnerability/risk assessment unique to the site for which the IJ is submitted" (FEMA, FY2026 NSGP NOFO, p. 27). An organization applying for several sites needs a separate assessment for each physical address, even when the projects are alike. Failing to provide one "may result in the rejection of the application" (p. 7).

The State Administrative Agency (SAA) checks the package and scores the IJ under the 40-point Appendix D criteria. It keeps the assessment and mission statement on file for FEMA (pp. 28, 32–35). FEMA's IJ checklist instructs applicants to make the IJ self-contained for federal review. Put the assessment's relevant findings into the IJ instead of referring the reader back to the assessment. The Investment Justification guide covers that step.

What the assessment has to show

The NOFO prescribes no format and names no qualified assessor. The FY2026 IJ form organizes risk as threat, vulnerability, and consequence. Appendix D rewards "a clear description of findings from a completed vulnerability assessment" and projects that address the vulnerabilities it identifies (pp. 73–74). An equipment list without the weakness behind each item leaves the IJ without a documented basis.

SAA requirements differ:

Check the current SAA instructions for:

• the organization's full legal name and the site's exact physical address, matching the IJ;
• the date it was completed, since some states limit how old it can be;
• the threats the site faces;
• specific weaknesses, with the consequences if each were exploited;
• recommended measures for each weakness, and which of them you plan to request.

Submit the assessment only through the channel the SAA specifies. Because it documents site weaknesses, limit access to people who need it.

Who can do the assessment

Choose a source your SAA accepts, with enough time to obtain a written, site-specific report.

Protective Security Advisors (PSAs) are CISA field staff assigned by region (CISA). The SAFE fact sheet describes a free visit with voluntary mitigation options, while the Infrastructure Survey Tool produces a more detailed report and comparative dashboard. CISA publishes neither nonprofit eligibility rules nor wait times for these services. Request an Assist Visit through CISA field staff or the regional office well before the application window.

CISA's free Houses of Worship Security Self-Assessment exports an editable report and a spreadsheet of options. A paper version and user guide are also available, and schools can use CISA's K-12 School Security Assessment Tool. The house-of-worship tool asks for a facility name, city, state, and date, but not a street address. Add the legal name and exact site address if the SAA requires them; Florida will not review or score an assessment without that address.

For Jewish institutions, Secure Community Network's 2025 NSGP assessment tool requires a member of its professional staff or a recognized community security director to review the recommendations section. SCN warns that the tool alone may not satisfy every state's rules. Our synagogue security grants guide covers those community resources.

NSGP funds cannot cover the assessment

The FY2026 NOFO lists initiatives that fund risk or vulnerability assessments, development of assessment models, and development of the IJ as unallowable costs (p. 17). Subrecipients also "cannot claim pre-award costs" (p. 19), and the assessment must exist before the application. Use a free assessment source that your SAA accepts or pay from non-NSGP funds. The allowable costs guide covers the remaining cost rules.

Keep the assessor out of the sale

Choose an assessor with no stake in the later sale. Under 2 CFR 200.319(b), a contractor that drafts specifications, statements of work, invitations for bids, or requests for proposals cannot compete for that procurement. The FY2026 NOFO extends the restriction to contractors that help develop grant applications, project plans, or budgets (p. 51). Cal OES also bars a security company that prepares the assessment from bidding on the installation. If a prospective bidder prepared yours, ask the SAA in writing whether that firm may compete. See the procurement rules and vendor guidance.

Every request has to trace to a finding

The SAA scores whether each requested item is "tied to a vulnerability that it could reasonably address/mitigate" (Appendix D, p. 75), and the IJ budget table asks which vulnerability each line addresses. Cal OES warns that equipment without a direct link to an assessment finding may not be funded or may be put on hold. FDEM gives a concrete example: a request for door locks needs an assessment that identifies the building's access-control weaknesses.

Start with the assessment findings, then choose the projects. Each requested item should point to a specific weakness in the assessment's own terms, and the IJ should use the same terms.

Repeat applicants and older assessments

An assessment is a snapshot, and the NOFO sets no age limit for it. Some states do. Indiana accepts a prior assessment no more than three years old with no substantive changes, and Cal OES accepts one that is still current and applicable. Completed security projects, new incidents or threats, renovations, and changes in how the building is used are all reasons to update it, whatever its age.

When to get it done

Finish the assessment before the notice appears. FEMA posted the FY2026 notice on Grants.gov on June 24, 2026, and some state application windows closed within weeks. Check the current NSGP status and state deadlines; the application guide places the assessment in the full submission sequence.