Security camera grants: NSGP rules for nonprofits

What the camera entry covers

Appendix A of the FY2026 NSGP notice of funding opportunity (NOFO) limits equipment to the Authorized Equipment List (AEL) codes it prints. It describes code 14SW-01-VIDA, "Systems, Video Assessment, Security," this way (p. 63):

"Camera-based security systems utilizing standard, low light, or infrared technology. (License plate reader and facial recognition software are NOT allowed.)"

The entry describes a system and names no components. Several other codes can belong to the same camera project: 04AP-06-VIDA for video analytics, 04AP-11-SAAS for a cloud subscription that supports "camera networks," 10PE-00-UPS for uninterruptible power, and 21GN-00-INST for installation (pp. 59–63). The NOFO doesn't say which code covers a recorder, a network switch, or a monitor, so ask your State Administrative Agency (SAA) how it wants each budget line coded. The allowable-costs guide lists every FY2026 code. A matching code makes cameras an allowable type of equipment. Whether the project at your site is selected is a separate decision by the SAA and FEMA.

Recognition software the NOFO bars

Three entries in the FY2026 NOFO carry the same exclusion: the camera system code, the video analytics code, and the vehicle identification code each bar license plate reader and facial recognition software (pp. 59, 63). The analytics entry adds the one exception: "software to detect weapons through video analysis is allowed."

FEMA's online AEL page for 04AP-06-VIDA gives facial and license plate recognition as examples of what analytics can do, then adds an NSGP note barring both. For NSGP, the note and the NOFO control. Ask each bidder to list every software license and module in its quote, so you can see whether a recognition feature is included, and to price any weapons-detection analytics on a separate line.

Section 889: check every component

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 bars FEMA award funds from paying for covered telecommunications and video surveillance equipment and services. The FY2026 NOFO applies it to recipients, subrecipients, contractors, and subcontractors and points to FEMA Policy 405-143-1, signed May 10, 2022, for the details (pp. 17–18). Under 2 CFR 200.216, covered equipment and services include:

• telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation, or any subsidiary or affiliate;
• video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company, or any subsidiary or affiliate, "[f]or the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes";
• services provided by those companies or using that equipment; and
• equipment or services from an entity the Secretary of Defense reasonably believes is owned or controlled by, or connected to, the government of China.

The NOFO, the Preparedness Grants Manual, and FEMA's policy don't explain how that purpose language applies to a private nonprofit's security cameras. Until FEMA or your SAA says otherwise in writing, you should treat equipment from any of the named companies as barred from purchase with award funds.

How far the ban reaches

FEMA's policy covers purchases "of any dollar amount" by "any FEMA recipient or subrecipient or their contractor or subcontractor." It bars award funds for any equipment, system or service that uses covered equipment "as a substantial or essential component of any system," and it defines that phrase as "any component necessary for the proper function or performance of a piece of equipment, system, or service." Its definition of telecommunications equipment names "video surveillance, and cloud servers."

In our reading, those terms reach the whole camera system: cameras, the network video recorder, video management software, a cloud video service, and the switches and routers that carry the video. On that reading, section B.1 of the policy has two practical consequences:

• New cameras on a covered recorder. Connecting grant-funded cameras to an existing recorder or video platform made by a covered company could make the covered recorder a substantial or essential component of the system the grant buys. Ask the SAA in writing before any purchase that ties into existing equipment.
• Renewals for covered gear. The policy bars using award funds to "[e]nter into, extend, or renew a contract" for a system that uses covered equipment, so a grant-funded license, warranty or service renewal for an existing covered system falls within its terms.

The policy also bars contracts "with entities that use covered telecommunications equipment or services as a substantial or essential component of any system," which, in our reading, reaches the vendor's own systems as well as what it installs. It doesn't address relabeled or private-label products. Because the regulation covers equipment "produced by" a listed company or its subsidiaries and affiliates, our reading is that a product is judged by who made it, whatever name is on the box.

What to collect and what the contract needs

Get the manufacturer and model number of every camera, recorder, storage device, switch, router, and software product in each quote, including the original manufacturer of any relabeled unit, and keep that list in the procurement file. Compare it against the covered companies before you sign, and ask the SAA about any manufacturer you can't place.

Every FEMA-funded contract and subcontract, including a purchase order, must carry the Section 889 provision. FEMA's Contract Provisions Guide (Version 2.2, September 2026, section 11) offers a sample clause. Under that clause, the contractor may not provide covered equipment as part of its performance, must report covered equipment it finds during the job "[w]ithin one business day," with the brand and model number, must send mitigation details within 10 business days, and must pass the clause to its subcontractors. Policy 405-143-1 lets a recipient or subrecipient draft its own provision instead.

A vendor's representation under the Federal Acquisition Regulation (FAR) doesn't replace the component list or the contract provision. FEMA's policy itself notes that the FAR "does not technically apply to grants, cooperative agreements, or loans."

The organization makes its own certification. Under 2 CFR 200.216(e), a subrecipient that accepts a grant "is certifying that it will comply" with the prohibition, and the rule says no further certification is required beyond that one and those provided with payment requests and financial reports.

The FCC's 2026 import and marketing bar

The Federal Communications Commission (FCC) enforces a separate rule. Its Public Notice DA 26-635 (June 26, 2026) prohibits continued importation and marketing of certain previously authorized equipment added to its Covered List in 2024 or earlier, and states that the prohibition "will not affect the continued use or operation of already-purchased communications equipment." The FCC rule governs what may be imported and marketed; FEMA's rule governs what grant funds may buy. A product can pass one test and fail the other, so check both.

Licenses, cloud storage, warranties and service

The FY2026 NOFO allows "maintenance contracts, warranties, repair or replacement costs, upgrades, and user fees" (p. 66). FEMA's Preparedness Grants Manual (July 2026, section 3.3) adds licenses to that list and sets the time limit:

"When purchasing a stand-alone warranty or extending an existing maintenance contract on an already-owned piece of equipment system, coverage purchased may not exceed the POP of the award used to purchase the maintenance agreement or warranty. As with warranties and maintenance agreements, this extends to licenses and user fees, as well."

POP is the period of performance. Coverage bought as part of the original purchase may run past it, if that purchase is "consistent with that which is typically provided for, or available through, these types of agreements, warranties, or contracts." For a camera system, you should buy the software license, the cloud storage subscription, and the warranty with the equipment, at a term normal for that product. A renewal bought later can run only to the end of the period of performance of the award that pays for it. Cloud services fit code 04AP-11-SAAS only when they "support security systems" (NOFO, p. 60).

Plan for the years after the award. The NOFO makes recipients "responsible for obtaining and maintaining all necessary certifications and licenses for the requested equipment, whether with NSGP funding or other sources of funds" (p. 64). It also says applicants should weigh the cost of buying against leasing, "especially high-cost items and those subject to rapid technical advances" (p. 65).

Paying a company to monitor video

Neither the FY2026 NOFO nor the Preparedness Grants Manual addresses central-station alarm monitoring or live video monitoring by an outside company. Before you budget a monitoring fee, ask the SAA in writing whether it is allowable and which budget line it belongs on, and keep any term inside the period of performance. If the service puts people on watch for you, ask too whether the SAA treats it as contracted security, which the NOFO ties to Information Bulletin 441 (p. 67).

Installation and environmental review

Mounted cameras need environmental and historic preservation (EHP) screening. FEMA's EHP screening form lists "closed circuit television (CCTV) cameras" among the physical security enhancements it covers. For equipment, the form exempts a project only when the entire project "is limited to purchase of mobile/portable equipment and there is no installation needed."

The form asks for a labeled color photo of each place equipment will attach to a building or structure, the depth, length, and width of any digging or trenching, and the age and historic status of the buildings involved. That includes a trench for a cable run to a pole or an outbuilding. FEMA's policy exempts "mobile and portable or plug-in equipment where no equipment requires permanent installation in or on existing buildings or structures," but only in its section on communications projects. Ask the SAA before you skip the form for any camera that mounts to a structure.

FEMA's EHP policy offers one narrow shortcut. After FEMA approves a screening form for interior construction in a building less than 43 years old, later interior construction projects at that location can be considered "previously approved" for the approval year plus two more calendar years. FEMA applies this case by case. Any project with exterior changes or ground disturbance still needs a form (FEMA Policy 108-023-1, Revision 2, section C.2.b). Ask the SAA whether it treats an interior camera installation as interior construction for this purpose. The EHP review guide covers the full package and timing. Work may not start until all EHP requirements are met.

What the application needs to show

NSGP applications go through a state and federal review, and the NOFO's criteria include "[a]lignment between the project activities requested within the physical or cyber vulnerabilities identified in the organization's vulnerability assessment" (p. 30). A camera request is easier to defend when the vulnerability assessment names the gap the cameras close. CISA's Physical Security Performance Goals for Faith-Based Communities (December 2023), for example, recommend monitoring "parking areas and all access and entry points with video surveillance systems."

Before you request estimates, write down the facts the Investment Justification (IJ) and budget will need to carry:

• what the system needs to do at each location, such as detect someone at the perimeter, let staff see who is at a door, or record for later review;
• which entrances, parking areas, and interior spaces it covers, and the assessment finding behind each one;
• how many cameras, recorders, storage devices, and licenses it needs;
• who will watch the video, and when;
• where each camera mounts and what cabling, conduit, or trenching it needs; and
• the AEL code for each budget line, with shipping and tax reflected in the costs (NOFO, p. 64).

Describe the performance you need, and keep brand and vendor names out of the application. When you buy, the NOFO treats a brand-name-only specification as a restrictive practice (p. 50), and a contractor that helps develop the application, project plan, or budget can't compete for the resulting purchase (p. 51). The vendor guide explains what a neutral, grant-ready quote contains, and the procurement guide covers competition after award.

Network security and recording law

The NOFO lists "[i]mproving cybersecurity of security technologies (e.g., CCTV systems)" as an example project under its cybersecurity priority (p. 13). As a best practice, it asks funded organizations to build cybersecurity into the design, development, operation, and maintenance of technology investments, and it requires reasonable measures to safeguard personally identifiable information under 2 CFR 200.303(e) (p. 42). If the assessment identifies a network weakness, the equipment list includes codes for network firewalls (05NP-00-FWAL), intrusion detection (05NP-00-IDPS), and remote authentication (05AU-00-TOKN).

The FY2026 NOFO sets no rule on where cameras point, whether they record sound, what signs to post or how long to keep footage. State law does, and it differs: some states require every party's consent to record a conversation (Reporters Committee for Freedom of the Press, Reporter's Recording Guide), and laws on cameras near restrooms and changing areas, biometric data, and video retention also vary. Have local counsel review the camera plan, including audio settings, before installation.

Door hardware, card readers, and entry systems raise a different set of approvals. See access control grants.