$200,000 per site of federal security money. Which stream are you in, and what can it actually buy?

Why the stream question is the one that disqualifies people

NSGP is two pots of $150,000,000. One is divided among 44 designated high-risk urban areas; the other among 56 states and territories, for everyone outside them. You compete only inside your own pot. That’s why the boundary is worth getting right, and why getting it wrong is fatal rather than unlucky. Missouri’s reissue of the federal notice puts it in one sentence: “if the incorrect funding source is chosen, the application will be ineligible for funding.” Your state checks your location. Then federal staff check it again.

The trap is that the urban area is not the metro area. Its footprint is drawn by an Urban Area Working Group, and the federal notice doesn’t publish those footprints at all. It tells applicants to ask their state agency for “the UAWG-defined high-risk urban area footprints.” Where states do publish them, the gap is wide. The Chicago urban area is Cook County and the City of Chicago; the metropolitan area it takes its name from spans fourteen counties across three states. Ohio has published single-county footprints for all three of its urban areas, though the Cincinnati metro reaches into Kentucky and Indiana. New York’s stops at Westchester, Nassau and Suffolk, so a synagogue in Rockland County competes for a different pot than one four miles away in Westchester, and a much smaller one.

7 of the 44 urban areas have a footprint published by their state agency, and those are the ones this page can show you. For the rest it says so and sends you to the agency. Guessing a boundary from a metro name is the mistake this page exists to prevent, so we won’t make it on your behalf. FEMA keeps the current list of State Administrative Agencies if you need the contact.

What the money can buy

• Contracted security personnel: up to 100% of the award

  Guard services are the least ambiguous thing NSGP funds, and the cap that used to require a waiver is gone. "Private contracted security guards" is the first example project type in the FY26 funding-priorities table. Off-duty law enforcement working as contract security counts; hiring public safety personnel does not. One limit that catches people: NSGP funds may not be used to purchase equipment for contracted security.

  “Subrecipients may use 100% of the NSGP funds awarded for contracted security personnel.”

• Maintenance, licences and user fees

  Maintenance contracts, warranty coverage, repair and replacement, licences, upgrades and user fees are all allowable. Coverage bought as part of the original system purchase may run past the period of performance; a standalone warranty, or an extension on equipment you already own, may not.

  “Maintenance and sustainment costs, such as maintenance contracts or agreements, warranty coverage, repair or replacement costs, licenses, upgrades, and user fees are allowable.”

• Planning, training and exercises

  Security plans and protocols, emergency contingency plans, evacuation and shelter-in-place plans, active shooter training, Stop the Bleed and AED training and kits, and security exercises. Training costs are limited to attendance fees and related materials — overtime, backfill and travel are not allowable, and training must address a threat or vulnerability named in your Investment Justification.

• Management and administration: 5%

  A nonprofit receiving a subaward "may use and expend up to 5% of each subaward for M&A purposes associated with that subaward" — reporting, inventory, financial documentation. An organization with more than one subaward must account for M&A separately for each.

• Construction and renovation: 15%, with prior approval

  NSGP money cannot be spent on construction or renovation without prior written FEMA approval, and even then the total may not exceed 15% of the award. Some equipment installation counts as construction — ask the SAA before assuming it does not, because this is also what triggers environmental and historic-preservation review.

The equipment list, in full

NSGP equipment is “limited to select items on the Authorized Equipment List” and these 36 codes are that list. If what you want is not here, NSGP cannot buy it, which is worth reading before you price anything. One rule cuts across all of it: no FEMA award money may buy covered telecommunications equipment under Section 889 of the FY2019 NDAA, carried into grants by 2 C.F.R. § 200.216 and into contracts by FAR 52.204-25, which rules out several camera brands and the labels reselling their hardware.

What NSGP will not pay for

• Pre-award costs — nothing you buy before the award is made can be claimed
• Organization costs and operational overtime
• Hiring public safety personnel (off-duty law enforcement working as contract security is the exception)
• Overtime and backfill
• General-use expenditures
• The vulnerability assessment itself, and the cost of writing the Investment Justification
• Developing risk or vulnerability assessment models
• Initiatives that study technology development, or proof-of-concept projects
• Anything where a federal agency is the beneficiary, or that enhances federal property
• Passing benefits through to organizations that are not themselves eligible

The second-to-last of those catches people out every year: the grant will not pay for the vulnerability assessment it requires you to have, nor for the cost of writing the application. Both come out of your own budget, before any award exists.

Guards, cameras, and the honest answer about monitoring

Contracted security personnel are the least ambiguous thing NSGP funds. Up to 100% of an award may go to them, subject to FEMA Information Bulletin 441. That cap used to require a waiver. “Private contracted security guards” is the first example project type in the FY2026 funding-priorities table. Cameras are just as clear under AEL code 14SW-01-VIDA, with installation covered separately, subject to a prohibition the notice repeats in three places: no licence plate readers, no facial recognition.

Remote video monitoring as a service needs a more careful answer than most pages give it, because the notice never names it. It’s fundable through three mechanisms:

• As a subscription service supporting a camera network. AEL 04AP-11-SAAS covers subscription services "that support security systems such as access controls, camera networks, cybersecurity services, or other critical infrastructure security".
• As a sustainment user fee on a funded system. Maintenance and sustainment costs expressly include "licenses, upgrades, and user fees". Coverage may not run past the period of performance unless it was bought as part of the original system.
• As contracted security personnel. Up to 100% of an award may go to contracted security personnel, subject to FEMA Information Bulletin 441.

Anyone who tells you the program explicitly funds remote monitoring is quoting a sentence that does not exist. Budget it through one of those three routes, and confirm the structure with your state agency before you write it into an Investment Justification.

Then there’s the arithmetic. A $200,000 ceiling sounds like a lot until you set it against a single guard post for one year: wage, employer burden, supervision, turnover and margin. Our guard cost calculator works that number out from your own state’s published wage data. That comparison is usually why an application ends up built around monitoring rather than a body on site.

How applications are scored

Your state agency scores the Investment Justification out of 33 points. Then comes the arithmetic that decides most outcomes: Final Score = SAA Score × Multiplier + Bonus Points. The multiplier is ×3 for ideology-based, spiritual and religious organizations, ×2 for secular medical and educational institutions, ×1 for everyone else. Organizations that have never held an NSGP award get 15 points added. Because the multiplier applies to the whole total, a synagogue and a food bank writing identical applications finish 66 points apart. That gap is decided before you write a word, and no amount of good drafting closes it.

Two sentences in that matrix are worth more than the rest of it combined. The first is an invitation most applicants never take up:

“Subapplicants may also draw from incidents that have occurred at closely related/similar organizations either domestically or internationally; the subapplicant should make the connection that they are at risk for the same reasons.”

That is a federal scoring rubric telling you to cite attacks on organizations like yours, anywhere in the world, and explain why the same reasoning puts you at risk. Top marks need “multiple, detailed, and specific threats or attacks.” For houses of worship that record exists and is public. Our synagogue attacks tracker compiles US incidents with a source on every row for this use, and CISA’s houses of worship resources cover the assessment side.

The second sentence is the one that costs applications their funding:

“Local crimes such as burglary, theft, or vandalism without a terrorism, extremism, or hate-related nexus may provide contextual justification for NSGP funding.”

Read that word carefully. Contextual justification is not risk justification. An application built on a catalogue of break-ins and stolen catalytic converters, with no hate, extremism or terrorism nexus, scores in the bottom band of the heaviest question on the form. Then that low score gets multiplied.

What you need before the window opens

• 501(c)(3) status

  The organization must be described under section 501(c)(3) of the Internal Revenue Code and exempt under section 501(a). Private colleges and universities qualify; public schools do not. IRS — Exemption requirements, 501(c)(3) organizations.

• A SAM.gov account with a UEI

  An active SAM.gov registration including a Unique Entity Identifier is required. This is the single most common reason an otherwise strong application misses a window. SAM.gov — entity registration and the Unique Entity ID.

  The NOFO’s own words: "SAM.gov registration can take several weeks. Begin that process today."

• A site-specific vulnerability assessment

  One assessment per physical address, and every activity in the Investment Justification must align to it. Failure to provide a unique assessment for each site can have the application rejected outright. NSGP will not pay for the assessment.

• An Investment Justification, one per site

  The current year’s fillable IJ form, one per physical address — "IJs CANNOT include more than one physical site." Older or non-fillable versions are rejected and the application deemed ineligible.

• A mission statement

  Including "any mission implementation policies or practices that may elevate the organization’s risk" — the sentence that connects what you do to why you are a target.

• Your most recent audit or financial statement

  If there is no completed audit, or it is more than three years old, the most recent annual financial statement.

• An address you occupy — not a P.O. Box

  Projects must be for the location the nonprofit occupies at the time of application, and equipment may be installed on real property "owned or leased by the nonprofit organization". Leasing does not disqualify you, whatever you may have read.

Where the FY2027 cycle stands

The FY2026 window closed on July 24, 2026, so FY2027 is the cycle to prepare for. As this is written there’s no FY2027 notice of funding opportunity and no enacted FY2027 appropriation. The federal government is running on a continuing resolution at FY2026 levels. FY2026 carried $300,000,000. A March 2026 letter to appropriators asked for $1 billion; a House proposal put it at $315 million; none of it is settled. This page won’t quote an FY2027 number until one exists. For the funding history behind those arguments, the Congressional Research Service keeps a short primer on the program and its appropriations, which records the rise from $25 million in FY2005 to $300 million now.

Expect competition. In FY2024, the last cycle with published numbers, FEMA received more than 12,000 applications and funded roughly 4,000 of them, about one in three. That is the backdrop to the ×3 multiplier and the 15-point first-timer bonus: in a field that size, the arithmetic decides more than the prose does.

What you can plan around is the shape of the cycle. The notice published in late June this year with about a month to the federal deadline, and your state’s deadline lands two to three weeks before that. In FY2026, against a federal date of July 24, 2026, Illinois closed on July 6, Missouri July 8, New York and Washington DC July 10, Georgia July 15. The work that takes weeks has to be done before the notice appears, not after: SAM.gov registration, a site-specific vulnerability assessment, quotes for every line. You can also watch for the posting itself on Grants.gov, where each cycle’s opportunity goes up.

And the federal program is not the only money. State-funded programs run on their own calendars: New Jersey (closes September 11, 2026). Missing the federal window does not mean missing the year.

Methodology

Every federal figure on this page comes from the FY2026 NSGP Notice of Funding Opportunity (Assistance Listing 97.008, DHS-26-GPD-008-00-99, published June 24, 2026): the two stream allocations, all 44 urban-area allocations from Appendix B, all 56 state and territory allocations from Appendix C, the 36 equipment codes, the scoring matrix from Appendix D, and the multipliers. Both allocation tables reconcile exactly to $142,500,000 each, which is how we know the extraction is sound. FEMA’s own site blocks automated access, so the text was read from the Cal OES and Missouri reissues of the same federal document, cross-checked against each other, with the urban-area names from the FY2026 Homeland Security Grant Program notice. The original notice sits on FEMA’s server and opens fine in a browser.

State facts come from each state agency’s own page and are dated August 16, 2026. Where a footprint has not been published, this page says so rather than guessing. Where sources conflict, both are shown and neither is resolved here: Colorado’s agency names only the Denver counties while the federal appendix funds a separate Colorado Springs urban area. Grant rules change every cycle. Treat the linked source as authoritative, confirm with your State Administrative Agency, and if you find something out of date, tell us and we’ll correct it. This is general information about a federal grant program, not grant-writing or legal advice, and Blinkless is not affiliated with FEMA, DHS or any state agency.

Primary sources

Everything above can be checked against the government documents that set it. Several of these block automated traffic but open normally in a browser.

• FY 2026 NSGP Notice of Funding Opportunity (Cal OES copy of the federal NOFO)
• FY 2026 NSGP NOFO as reissued by Missouri DPS / Office of Homeland Security
• FY 2026 Homeland Security Grant Program NOFO — Urban Area Security Initiative allocations
• FEMA — Nonprofit Security Grant Program
• FEMA — FY 2026 NSGP Notice of Funding Opportunity (original PDF)
• FEMA — Authorized Equipment List
• FEMA — Grant Programs Directorate Information Bulletins
• FEMA — State Administrative Agency contacts
• Grants.gov — FY2026 Nonprofit Security Grant Program opportunity
• IRS — Exemption requirements, 501(c)(3) organizations
• IRS — Churches, integrated auxiliaries and conventions of churches
• SAM.gov — entity registration and the Unique Entity ID
• 2 C.F.R. § 200.216 — prohibition on covered telecommunications equipment
• FAR 52.204-25 — prohibition on covered telecommunications equipment or services
• Public Law 115-232, § 889 (FY2019 NDAA)
• CISA — Protecting Houses of Worship
• Congressional Research Service IF13201 — Soft Targets and the Nonprofit Security Grant Program
• NPR — Religious leaders and lawmakers push for $1 billion to secure houses of worship (May 2026)
• Connecticut DEMHS — Connecticut Nonprofit Security Grant Program

Reuse

The allocations, equipment codes and scoring figures are federal government output and are not ours to license. Our compilation of them — the extraction, the wording, the state-by-state notes — is free to copy and republish under a Creative Commons Attribution 4.0 license: credit Blinkless and link back to this page.

Frequently asked questions