Vendor requirements for FEMA-funded security work

Start with the buyer, not the funding source

Requirements follow the buyer and the award. A nonprofit, a school district and a city may all spend federal security money under different procurement rules. Before you price a job, find out who signs the contract, which award pays for it and which agency passes the money through.

The rest of this page uses the nonprofit NSGP subrecipient as the main case. For how the money moves and the stages of a sale, see the vendor orientation page.

Registration and exclusion checks

FEMA keeps no approved or preferred vendor list, and a product's fit in an allowable equipment category does not approve the vendor. The approved vendor list page sorts out the lists and registrations that get mistaken for approval.

A vendor to an NSGP nonprofit does not need a SAM.gov registration. FEMA's Procurement Under Grants Policy Guide (v2.1, July 2025) says the federal rules do not require subrecipient contractors to register. What matters is exclusion. A contract expected to reach $25,000 or more is a covered transaction, and the buyer must verify that the vendor is not excluded by checking SAM.gov, collecting a certification or adding a clause (2 CFR 180.300). Be ready to sign a suspension and debarment certification with your quote.

State registrations work differently. In the NSGP documents we reviewed from Florida, New York and Illinois, the state's vendor or grantee system binds the nonprofit, not its contractors. When a state agency is the buyer, its own vendor registration applies to you.

State licenses for the work

No federal rule licenses security installers or guard companies. State and local law may, and the regulated scope differs. A statute that names alarm systems may not settle whether camera-only or access-control-only work is covered. Ask the licensing board before bidding when the published scope is unclear, and keep its answer.

California's grant rules go furthest. Cal OES checks the contractor's license and says costs may be disallowed if the contractor lacks the correct one. Its bids and invoices must show the license number, make, model, quantity and unit cost (Cal OES State Supplement, March 2026).

For example, California requires a contractor license for work of $500 or more, with its C-7 classification covering closed-circuit video systems. Florida separately licenses alarm contractors under Chapter 489 and guard agencies and officers under Chapter 493. These examples are not a national survey. Confirm the law where the work occurs, including local permits.

Section 889 in practice

The FY2026 NSGP NOFO binds recipients, subrecipients "and their contractors or subcontractors" to Section 889. For video, the covered producers are Hytera, Hikvision and Dahua and their subsidiaries and affiliates; for telecommunications, Huawei and ZTE. FEMA Policy 405-143-1 also reaches systems that use covered equipment as a substantial or essential component, so a new camera tied to a covered recorder is a problem.

What this means for a vendor's paperwork:

• Name the original manufacturer and model of every camera, recorder, switch and other networked device in the quote. If a product is relabeled, name who produced it.
• Expect the Section 889 clause in every contract and purchase order, at any dollar amount (Contract Provisions Guide, section 11.1).
• Under FEMA's sample clause, report covered equipment you find during performance "within one business day," with the brand and model number, and flow the clause down to subcontractors (section 11.2).
• A Federal Acquisition Regulation representation in your federal contracting profile does not replace the grant clause. FEMA's policy notes the FAR does not technically apply to grants.

The buyer decides whether a purchase complies. The security camera guide covers the full rule, including existing systems.

Contract clauses you will be asked to accept

Every FEMA-funded contract must carry the applicable provisions of Appendix II to 2 CFR Part 200. FEMA's Contract Provisions Guide (v2.2, September 2026) lists the required clauses and their triggers for NSGP. FEMA does not recommend incorporating them by reference, so expect the full text in the contract.

FEMA also recommends clauses on access to records and program fraud. Read the buyer's contract because the applicable terms depend on contract type, value and award conditions.

Davis-Bacon: does prevailing wage apply?

Davis-Bacon requires prevailing wages on covered construction. The FY2026 NSGP NOFO does not mention it, but FEMA's Contract Provisions Guide v2.2 lists Davis-Bacon and Copeland as required for NSGP on construction contracts over $2,000. Work through the questions in order:

1. Is the contract for construction?The NOFO says "the installation of equipment may constitute construction and/or renovation" and tells recipients to ask their FEMA Preparedness Officer. Labor rules define construction to include installing equipment into a building (29 CFR 5.2). No source we found says whether a camera or access-control install counts. The SAA, working with FEMA, decides. Ask the buyer to get the answer in writing before you price the job.
2. Is it over $2,000?Below that, the clause does not apply.
3. If both answers are yes,the solicitation should include a Department of Labor wage determination, and the contract carries the full labor clauses with weekly pay and the anti-kickback terms (Contract Provisions Guide, section 3). Construction under NSGP also needs FEMA's prior written approval, which is the buyer's task.

Guard services are a different case. Labor rules treat guards as laborers only for the Contract Work Hours and Safety Standards Act (29 CFR 5.2). Our reading is that Davis-Bacon does not reach a guard contract, but no source states this for NSGP.

Build America, Buy America: does the domestic content rule apply?

The Build America, Buy America Act (BABA) preference applies only to infrastructure projects. NSGP is on the list of programs subject to FEMA's Buy America Preference Policy (Rev. 1, January 30, 2026). The questions:

1. Is the item consumed in, incorporated into or affixed to infrastructure?The NOFO excludes movable equipment that is not an integral part of the structure. FEMA's policy says removable "objects such as security cameras" are not subject. Fixed items such as doors, fencing or bollards are more likely to be covered, but FEMA gives no NSGP-specific list.
2. Is the building infrastructure?FEMA's policy says a privately owned non-residential building that does not serve a public function is not infrastructure, and it weighs whether the building is a place of public accommodation. How FEMA applies this to a house of worship under NSGP is unconfirmed.
3. Does a waiver apply?FEMA's Small Projects Waiver covers projects at or under the simplified acquisition threshold, currently $350,000, through February 20, 2028, with no application. Our reading: because NSGP caps requests at $200,000 per site, most single-site NSGP projects should fall under it. FEMA has not said so for NSGP, and whether the waiver is measured per site is unconfirmed.
4. If the project is covered and not waived,you sign a self-certification with your bid. Manufactured products need domestic components above 55% of total component cost; iron, steel and construction materials need all manufacturing in the U.S. (Contract Provisions Guide, section 13).

The buyer and its SAA make this call. Waiver requests go from the subrecipient through the pass-through agency to FEMA.

Insurance and bonding

We found no federal insurance minimum for contractors in 2 CFR 200.317 to 200.327, the Contract Provisions Guide or FEMA's procurement guide. Insurance levels come from the solicitation, the buyer's insurer or state licensing law. New York's guard employer checklist, for example, cites liability coverage of $100,000 per occurrence and $300,000 in aggregate.

Federal bonding minimums apply only to construction or facility improvement contracts above $350,000: a 5% bid guarantee and 100% performance and payment bonds, unless FEMA or the pass-through agency accepted the buyer's own policy (2 CFR 200.326). Few NSGP contracts reach that size. The NOFO lists "excessive bonding" as a restrictive practice, so a buyer should not demand more than the job justifies.

Records the vendor keeps

The nonprofit claims reimbursement with your paperwork, and auditors may come back to it years later. FEMA's recommended access-to-records clause gives DHS, FEMA, the Comptroller General and the pass-through agency access to the contractor's records pertinent to the contract. The buyer must keep award records for three years from its final financial report, and longer during an audit or dispute (2 CFR 200.334). Check the retention term in your contract and keep the job file at least that long:

• the quote or proposal, the contract or purchase order and every change order;
• itemized invoices that match the contract lines, one award per invoice;
• delivery and installation records, with manufacturer, model and serial number for each device, since the buyer's property records need a serial or identification number (2 CFR 200.313);
• manufacturer and Section 889 information, subcontracts and license copies; and
• for guard work, schedules and signed time records.

For environmental and historic preservation (EHP) review, give the buyer factual installation details on request: mounting, drilling, trenching, conduit and footings. The nonprofit prepares and submits its own EHP package and project description.

Requirements for contract guard companies

The FY2026 NOFO lets a subrecipient use up to 100% of its NSGP award for contracted security, requires compliance with Information Bulletin 441, and bars NSGP funds from buying equipment for contracted security. Keep guard equipment off any invoice the nonprofit will charge to the grant, and ask the buyer how its SAA wants guard services itemized.

• Licenses. Hold the agency license and each officer's license or registration that state law requires, and keep copies ready for the buyer's file.
• Contract value. The buyer applies procurement thresholds to the full anticipated value of the contract, not to one month's invoice.
• Existing contracts. An agreement you already hold with the nonprofit can be charged to the grant only if it was competitively procured under the applicable standards for this scope. Moving an uncompeted agreement onto the award is a noncompetitive purchase. Florida's SAA says contract security "must be competitively procured" and that sole source is not allowable (FDEM FY2024 application guide).
• Time records and invoices. Florida asks for the hourly or daily rate, the number of personnel and the hours. Keep signed shift logs that match each invoice as the work happens.
• Off-duty police. The NOFO allows off-duty law enforcement working in the capacity of contract security. Hiring public safety personnel, overtime and backfill are not allowed.

The security guard guide covers how guard costs fit the nonprofit's application and claims.

Cooperative contracts and GSA Schedules

A cooperative or schedule contract does not automatically satisfy the nonprofit's duty to compete. FEMA's December 2025 GSA fact sheet says, "Nonprofits are not eligible to use MAS." Access to state contracts varies; Washington, for example, admits qualifying public benefit nonprofits after a contract usage agreement.

FEMA's procurement guide treats an assignment that fails its four-part test as noncompetitive. Before relying on any vehicle, the buyer must establish:

• its authority to use the contract, and that the original buyer made it available for this use;
• that the original competition met 2 CFR 200.317 to 200.327 for a nonprofit;
• that the work fits the contract's scope by type, amount and geography;
• that the price is reasonable, with a cost or price analysis above $350,000;
• whether the contract carries every required federal clause; and
• that the SAA's subaward conditions allow it.

The nonprofit still follows the procurement method required for the full purchase. A vendor may provide the original solicitation, advertising, award documents and price list, but the buyer decides whether the vehicle qualifies. See the NSGP procurement guide for the buyer's rules.