NSGP rules for security vendors

Start with the buyer, not the funding source

The buyer's identity matters. A nonprofit NSGP subrecipient, a public school district and a local government may all receive federal security funding but follow different procurement rules. Do not choose a bidding method from the funding source alone. Identify the buyer, the award, the pass-through agency and the applicable state or local rules first.

Under 2 CFR 200.317, a state buying with federal funds uses the same policies it uses for its own money, plus a few federal sections. Every other recipient and subrecipient, including a nonprofit that receives NSGP funds through its state, follows 2 CFR 200.318 through 200.327. State law, local rules and the award itself can add to either.

The rest of this page addresses the first row: nonprofits paying with NSGP funds.

How NSGP money reaches the vendor

FEMA awards NSGP funds to each state's SAA, which makes a subaward to each selected nonprofit. The vendor contracts with and invoices the nonprofit. FEMA is not a party to the sale, and selection for funding does not award a contract to any vendor that supplied an estimate.

The payment model depends on the state subaward. FDEM, for example, calls NSGP "a COST REIMBURSEMENT grant program" in which the organization orders and pays for equipment, then claims it with purchase orders, invoices and proof of payment (FDEM FY2024 NSGP guide). The FY2026 NOFO adds that FEMA must review and approve non-disaster reimbursement requests before the state draws funds (p. 47). A grant does not put cash in the customer's account on the day of award.

Your right to be paid comes from your contract with the nonprofit. 2 CFR 200.305(b)(1) says the subrecipient "must make timely payments to contractors in accordance with the contract provisions." No source we have found settles how a "pay when the state pays" term interacts with claims that require proof of payment. Agree on payment terms in writing before work starts, and see NSGP reimbursement claims for what the customer must submit.

Stages of an NSGP sale

FEMA published the FY2026 NOFO on June 24, 2026. Information Bulletin 579 moved the deadline for SAAs to submit applications to FEMA from July 24 to 5 p.m. ET on July 31, 2026. Nonprofits faced earlier deadlines set by each state. The NSGP deadlines page tracks current dates.

Each subaward carries its own dates, which may be shorter than the federal period. The EHP guide explains the clearance step. As of October 16, 2026, FEMA has not published an FY2027 NOFO.

Helping plan the project versus bidding on it

2 CFR 200.319(b) excludes contractors that "develop or draft specifications, requirements, statements of work, or invitations for bids" from competing on those procurements. The FY2026 NOFO goes further. FEMA treats the practice as an organizational conflict of interest and "extends this restriction to contractors who assist recipients or subrecipients in developing grant applications, project plans, or budgets," including former employees who did that work (p. 51). If the conflicted vendor gets the contract, FEMA or the SAA can disallow the cost under 2 CFR 200.339.

FEMA has not drawn a line for every case. Labels do not control. Calling work a "free assessment," "budgetary quote," "consultation" or "courtesy design" does not preserve the vendor's eligibility if the work helped develop the application, project plan, budget, specifications, statement of work or solicitation. Our reading sorts vendor activity into three categories:

For the third category, the nonprofit should describe the facts to its SAA in writing and get an answer before the vendor bids. The NOFO requires recipients and subrecipients to disclose potential organizational conflicts of interest in writing to FEMA or the pass-through entity (p. 51). The guide to bidding on NSGP projects covers the conflict from inside an active solicitation, and the customer-side rules are in NSGP procurement requirements.

Gifts are a separate bar. Under 2 CFR 200.318(c)(1) and the NOFO (p. 51), the nonprofit's officers, employees and agents may not solicit or accept gratuities, favors or anything of monetary value from contractors. Offer none, including referral payments or personal discounts.

What vendors may say to prospects

A prospect who mentions a grant needs accurate expectations, not a promise. Language along these lines stays inside the vendor's role:

Some customers may be eligible to apply for security funding. Eligibility, project allowability, award selection and reimbursement are decided by the program and the administering agency. We can provide our existing product information and a requested estimate. Your organization or its independent grant advisor should develop the application, project scope, budget and procurement documents.

Vendors should not:

• draft or edit the Investment Justification, or supply a threat narrative;
• choose the vulnerabilities, or map their products into the applicant's narrative;
• promise eligibility, an award, approval or reimbursement; or
• suggest that working with them before the application assures them the contract after the award.

Product claims have limits too. FEMA says it does not "approve, endorse, certify, or recommend any contractors, individuals, firms, or products," and firms may not call themselves or their products "FEMA approved" or "FEMA certified" (FEMA). The page on whether NSGP has an approved vendor list covers what a vendor can truthfully say instead.

Where the next question is answered