The Investment Justification (IJ) is the scored narrative section of the Nonprofit Security Grant Program (NSGP) application. Reviewers read it against four published criteria. Funding decisions are made from what the IJ proves, not from what the applicant claims about its mission.
This guide walks through every section the IJ requires, what reviewers score, and the specific gaps that put credible applications outside the funded range.
What the Investment Justification Is
The IJ is a structured document required by the Federal Emergency Management Agency (FEMA) for every facility a nonprofit wants funded under NSGP. One facility, one IJ. Multi-site applicants submit one IJ per facility, with separate vulnerability assessments and budgets.
The current FEMA NSGP Notice of Funding Opportunity (NOFO) specifies the IJ template and scoring rubric. The template is published on the official FEMA NSGP page (https://www.fema.gov/grants/preparedness/nonprofit-security) ahead of each cycle and through the federal grants portal at https://www.grants.gov/.
Word limits apply per IJ section. The 2025 cycle capped Background at 1,500 characters and the four scoring sections at 5,000 characters each. The 2026 NOFO retained the same limits. Going over the cap truncates the narrative without warning.
The Four Scored Criteria
The IJ is scored against four criteria. Each carries explicit weight in the NOFO. Reviewers do not score off-rubric content.
| Criterion | What reviewers look for | Common failure |
|---|---|---|
| Risk | Documented threat picture tied to organization, faith group, ideology, location | Generic national references with no local documentation |
| Vulnerability | Specific security gaps the requested funding closes | Equipment proposals with no underlying assessment finding |
| Consequences | Concrete impact if an attack succeeds (occupancy, programs, community) | Adjectives instead of numbers |
| Effect of funding | Measurable reduction in the consequences described above | Restating the budget instead of explaining the security improvement |
The four criteria form a chain. If risk is documented but vulnerability is vague, the chain breaks and the score drops. Strong IJs read as one coherent argument from risk through funded mitigation, not four disconnected paragraphs.
Section 1: Background
Background sets the organizational and facility context. Reviewers use it to understand who the applicant is before they read the risk picture.
What goes here:
- Legal name of the 501(c)(3) and the IRS determination date
- Type of organization (synagogue, church, mosque, day school, community center, cultural institution)
- Facility address and what operates there
- Year the facility was built or acquired
- Total square footage and number of public-access points
- Typical and peak occupancy
- Hours of operation and major recurring events
- Number of staff, volunteers, and members served
Background is not the place for the mission statement. The mission statement is a separate required document. Repeating it inside Background wastes the 1,500-character cap.
Section 2: Risk
Risk is the documented threat picture. Reviewers want named threats and specific incidents, not statements about national patterns.
Sources that strengthen the risk narrative:
- FBI Hate Crime Statistics (https://www.fbi.gov/services/cjis/ucr/hate-crime) for bias-motivation data relevant to the applicant
- Local police reports filed by the organization
- Documented threats received by mail, phone, email, or social media
- Public statements by extremist groups naming the organization, denomination, or community
- Local news coverage of incidents at peer organizations in the region
- Denominational security agencies (Secure Community Network for Jewish institutions, Catholic Mutual Group, denomination-specific security offices)
What weakens the risk narrative:
- Quoting only national incident summaries without a local connection
- Citing risk that applies to every nonprofit (general crime, weather events)
- Inflating threat language without source documentation
- Listing incidents without dates or sources
Risk does not require a prior attack on the specific facility. Documented community-level pattern, denominational visibility, or received threats are enough when each claim has a citation.
Section 3: Vulnerability
Vulnerability translates the vulnerability assessment findings into the IJ. Every gap the IJ describes must trace back to a numbered finding in the assessment document. Every funded equipment line must trace back to a documented gap.
Standard vulnerability assessment structure (federal NSGP and most state programs accept this format):
- Facility walkthrough with photographs
- Identification of all access points (front, side, rear, loading, mechanical, roof, fire)
- Current security posture per access point
- Identified gap per access point
- Recommended mitigation per gap
The vulnerability section in the IJ summarizes the assessment, names the gaps the requested budget will close, and points the reviewer back to the assessment for detail.
Three gaps cause the most score loss:
Undocumented access points. The IJ lists front-of-house doors. The assessment omits loading docks, kitchen entries, mechanical room doors, fire exits, and roof access. If an attacker would use it, the assessment must address it.
Budget items without an assessment trail. The budget proposes $40,000 in fencing. The assessment never mentions perimeter as a gap. Reviewers cannot connect the dollar to the documented vulnerability.
Generic gap language. “Improve perimeter security” is not a gap. “No barrier preventing vehicle approach within 25 feet of the south sanctuary entrance” is a gap.
Section 4: Consequences
Consequences cover what happens if an attack succeeds at the funded facility. Reviewers score specificity. Numbers beat adjectives.
What to include:
- Peak occupancy with the date or event that produces it (High Holy Days for synagogues, Christmas Eve for churches, Eid for mosques, graduations for schools, festivals for community centers)
- Number of children, elderly, or mobility-limited individuals present at peak
- Programs that would be canceled or relocated for a documented recovery period
- Community functions the facility serves beyond the primary mission (polling location, food pantry, shelter)
- Cultural or historic significance if applicable
- Geographic role (the only synagogue in a 50-mile radius, the largest mosque in the region)
What loses points:
- “Significant consequences for the community”
- “Devastating impact on our members”
- “Loss of life would be catastrophic”
These add no information. Reviewers want occupancy at 950 on Yom Kippur, not “high occupancy during religious holidays.”
Section 5: Effect of Funding
Effect of funding ties the requested budget back to consequence reduction. This is the section that most often disconnects from the rest of the IJ.
The mechanism reviewers want to see:
- The vulnerability section identified a specific gap
- The budget funds a specific mitigation for that gap
- The mitigation produces a measurable reduction in the consequence
Example chain:
- Vulnerability: south sanctuary entrance has no vehicle barrier; closest paved approach is 12 feet
- Budget: $38,000 for six ASTM F2656 M30 rated bollards at the south entrance
- Effect: vehicle ramming attempt at peak service (occupancy 950) blocked before reaching the structure
When the chain holds for every funded line, the IJ scores in the funded range. When the budget contains items the vulnerability never raised, the IJ scores below the line.
The Mission Statement (Separate Required Document)
The mission statement is not part of the IJ. It is a separate document submitted with the application, required for NSGP, and limited in length (typically 250 to 500 words depending on the cycle).
What it establishes:
- The ideology, beliefs, mission, or symbolic profile that places the organization at risk
- Public visibility (signage, events, online presence, media coverage)
- Community served and its identifying characteristics
What it is not: the IRS-filed mission statement. The NSGP mission statement is built for the risk question, not the tax-exemption question.
A strong NSGP mission statement names the denomination, describes visible programs, and references documented community-level threats without overstating them.
Common Reasons IJs Fall Below the Funded Line
Across review cycles, the same patterns recur in IJs that score above eligibility but below the funded threshold:
-
Risk borrowed from a peer organization. Reviewers see the same paragraph in multiple applications from the same denomination or region. Risk has to be local.
-
Vulnerability summarized in two sentences. Reviewers cannot evaluate gaps they cannot see. The assessment exists. Surface its findings.
-
Consequences written in adjectives. Replace every adjective with a number, a date, or a named program.
-
Effect of funding restates the budget. The budget already lists what is purchased. Effect of funding explains what the purchase changes.
-
Mission statement copied from the IRS Form 1023. The audience and purpose are different. Rewrite for the risk picture.
-
Cost categories misaligned with the NOFO allowable cost list. The current NOFO publishes the allowable cost categories at https://www.fema.gov/grants/preparedness/nonprofit-security. Items outside those categories cannot be funded.
-
Word count overruns. Characters cut off mid-sentence. Sections submitted at 4,999 of 5,000 characters lose nothing; sections that hit 5,000 and continue are truncated without warning.
What to Submit Alongside the IJ
The IJ is one document in a larger submission package. The full federal NSGP submission package includes:
- Investment Justification (one per facility)
- Vulnerability assessment (one per facility, supports the IJ)
- Mission statement
- Budget detail (line items, vendor quotes, cost basis)
- 501(c)(3) IRS determination letter
- A SAM.gov Unique Entity Identifier (UEI), active and not expired. Register or renew at https://sam.gov/
- State Administrative Agency (SAA) cover documents per state
State NSGP-style programs (NY SCAHC, CA CSNSGP, NJ NSGP, IL NSGP-IL, PA NSGFP, MA CNSGP, CT NSGP, AZ NSGP, MD PAHC, OH OSG, TN HOW, WA NROSGP, GA FPC, CO NSGP) require additional state-specific documents. Each state SAA publishes its own checklist.
Procurement Rules That Affect the Budget
Procurement under NSGP follows 2 CFR Part 200, the federal Uniform Guidance, published at https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200. Above the micro-purchase threshold, purchases require documented competition. The procurement file must show:
- Vendor list contacted
- Quotes received with dates and amounts
- Selection rationale
- Vendor responsibility check (confirm the vendor is not federally debarred via the SAM.gov exclusions search at https://sam.gov/content/exclusions)
- Contract or purchase order
- Invoice
- Proof of payment
Procurement gaps are the most common reason an awarded organization cannot draw down funds. The IJ does not address procurement directly. The award does. Anticipating procurement at the IJ stage keeps the budget realistic and the timeline workable.
Period of Performance and the IJ Timeline
NSGP has a three-year period of performance from award date. The IJ does not include a timeline section, but reviewers read the budget and the proposed mitigations against a realistic schedule.
Equipment with long lead times (specialized barriers, custom doors, integrated access control systems) requires the period of performance from the start. Items that take eighteen months to procure and install cannot reasonably be deferred to year three.
How to Open the IJ for the Risk Section
The first paragraph of the risk section determines how the reviewer reads the rest. Two openings:
Weak opening:
Antisemitism is on the rise across the United States, and synagogues face increasing threats from a variety of sources. Our congregation, like many others, is concerned about the safety of our members.
Strong opening:
[Name of Congregation] is a Conservative synagogue in [City], serving approximately 380 member families. The synagogue is the largest visible Jewish institution within a 35-mile radius. Between January 2024 and December 2025, three antisemitic incidents were reported to [Local Police Department] within 5 miles of the facility, including vandalism of the congregation’s signage in March 2024 (police report [number] available on request) and a threatening letter received at the synagogue office in November 2024.
The strong opening names entities, dates, and reports. The weak opening could describe any synagogue. Reviewers score what they can verify.
What Happens After Submission
The application moves through several review layers:
-
State Administrative Agency review. Each SAA in the applicant’s state ranks submissions and forwards the top scorers to FEMA. SAA-level scoring determines whether the IJ reaches FEMA at all.
-
FEMA review and scoring. FEMA panels score the IJs that survive SAA review against the four criteria. Highest-scoring IJs are funded until the appropriation is exhausted.
-
Award notification. Typically late summer or early fall for spring submissions. The award notice opens the period of performance.
-
Environmental and Historic Preservation (EHP) review. Funded projects with construction or ground disturbance components require EHP clearance before procurement begins. The current EHP guidance is published at https://www.fema.gov/grants/tools/environmental-historic-preservation.
-
Procurement and drawdown. Competitive procurement under 2 CFR Part 200, then reimbursement requests through the SAA portal.
The IJ is the gate. Everything downstream is operational.
Frequently Asked Questions
Does the IJ need to be written by a grant writer?
Technically, no. The NOFO does not require a credentialed grant writer. In practice, the IJs that score in the funded range almost always reflect three things most internal authors do not have together: pattern recognition across many prior cycles, calibration to the current NOFO scoring rubric (which shifts between years), and an editor who reads the four sections as one chain rather than four paragraphs. Internal teams can produce a passing IJ when the executive director, security committee chair, and a writer all dedicate uninterrupted weeks to the document and have access to a vulnerability assessment that is already strong. Most do not have that bandwidth. The most common pattern in denials is an internally written IJ that documents risk well, mentions vulnerability briefly, and never closes the effect-of-funding chain. A specialist who has read hundreds of funded and denied IJs catches that gap on the first read.
Can the same IJ be used for state and federal programs?
The narrative content can be reused. The structure, character limits, and required attachments differ between federal NSGP and state programs. State applications require state-specific forms and (in several states) additional documents like photographs in the assessment. Copy-pasting the federal IJ into a state portal without restructuring is the most common reason credible state applications are rejected at the administrative review stage before scoring even starts.
What if the vulnerability assessment is old?
If the assessment is more than 18 months old, refresh it. Add photographs if the prior version did not have them. Reviewers downgrade IJs that cite assessments from prior cycles without updates. A professional reassessment typically catches three to five gaps a self-refresh misses, especially around back-of-house access, mechanical room doors, and roof points that are not part of the worship space and rarely surface during a self-walkthrough.
Can the IJ reference incidents at peer organizations?
Yes, when the peer organization is geographically or denominationally relevant. National incident summaries are weaker than local peer incidents within the region. The strongest IJs cite three to five specific peer incidents with dates, locations, and either news links or police report numbers. Building that file takes time most internal applicants underestimate.
Does the IJ score affect future cycle applications?
No. Each cycle is scored independently. Re-applicants are not penalized for prior denials. Strengthening the section that scored lowest in the prior cycle is the standard re-applicant strategy. The challenge is identifying which section actually scored lowest, since FEMA returns a numeric score without a breakdown by criterion. A specialist who has reviewed denial letters from multiple cycles can usually identify the weak section from the narrative pattern alone.
What We Do
Security Grant Advisors drafts IJs for nonprofits applying to federal NSGP and state programs. The work covers vulnerability assessment review, threat documentation, IJ drafting against the current NOFO rubric, budget assembly with vendor quotes, and submission through the SAA portal.
For organizations that have been denied in prior cycles, we run a rewrite engagement focused on the lowest-scoring section. For first-time applicants, we run a six-week engagement that produces the full submission package.
If you are planning a 2026 or 2027 application and want a review of an existing IJ draft, contact us or call (855) 674-7946.
Official Sources
Every claim in this guide traces back to a primary federal source. Confirm the current cycle requirements at the official URLs below before submission.
- FEMA Nonprofit Security Grant Program (NSGP): https://www.fema.gov/grants/preparedness/nonprofit-security
- Grants.gov opportunity portal: https://www.grants.gov/
- SAM.gov (Unique Entity Identifier registration): https://sam.gov/
- SAM.gov Exclusions (federal debarment search): https://sam.gov/content/exclusions
- 2 CFR Part 200 (Uniform Guidance for federal awards): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
- FEMA Environmental and Historic Preservation (EHP) review: https://www.fema.gov/grants/tools/environmental-historic-preservation
- FBI Hate Crime Statistics: https://www.fbi.gov/services/cjis/ucr/hate-crime
- U.S. Department of Homeland Security: https://www.dhs.gov/
State Administrative Agencies publish state-specific NOFOs and submission portals. Confirm the current SAA contact for your state through the FEMA grants portal above.