An award letter from the Nonprofit Security Grant Program feels like the end of a long process. It is closer to the beginning of one. The award opens a 36-month period of performance during which your organization carries real federal compliance obligations, and those obligations do not end when the equipment is installed.
The short answer: the money is reimbursed rather than advanced, the paperwork runs the full three years, and the rules that apply to you come from your state, not directly from FEMA. Organizations that plan for the installation and not the administration are the ones that run into trouble in year three.
The award starts a three-year clock
The period of performance for NSGP is 36 months. Everything the grant pays for has to be procured, delivered, installed, and invoiced inside that window. Costs incurred after it closes are not allowable, and neither is work committed but not completed.
Two things surprise most first-time awardees.
The first is that funds do not arrive with the award letter. Your State Administrative Agency (SAA) has 45 calendar days from receipt of the federal award to pass funding through to subrecipients, and the subaward agreement has to be executed before anything moves. The clock and the cash do not start on the same day.
The second is that extensions are hard to get. FEMA expects extension requests at least 120 days before the period of performance ends, considers them only for specific reasons such as vendor contractual commitments or an environmental review that cannot be completed in time, and typically grants no more than six months. An extension also cannot change the scope of the project you were funded to do. Planning to ask for more time later is not a plan.
You are a subrecipient, and that changes who you answer to
This is the single most useful thing to understand about post-award NSGP, and it is the thing most published guidance gets wrong.
In NSGP, the SAA is the recipient of the federal award. Your organization is a subrecipient. The distinction is not academic. It determines what you file, when, and to whom.
The federal reporting framework, meaning quarterly Federal Financial Reports and the biannual performance report FEMA now uses, belongs to the recipient. Those are filed by the SAA in FEMA’s grant system, which nonprofits do not have access to. Your obligations are whatever your subaward agreement imposes on you, and they exist because the SAA needs your information in order to meet its own federal deadlines.
In practice that means:
- Your reporting cadence is set by your state, and it often differs from the federal quarterly and biannual rhythm
- Your submission method is a state portal, a state email address, or a state form, and these vary widely
- Your deadlines are frequently earlier than the federal ones, because the SAA is building its report out of yours
An organization holding awards in two states will have two different sets of obligations for the same federal program. There is no single national checklist, and anything presenting one is describing the SAA’s job rather than yours.
What runs for the full three years
Underneath the state variation, the same categories of work recur across every award SGA manages.
Reporting. Financial and programmatic, on whatever schedule the subaward sets. The federal framework allows FEMA to withhold future awards and payments where reports are late, incomplete, or show insufficient progress, and SAAs pass that pressure down. Reporting continues in quiet periods when nothing has been purchased.
Procurement. Federal procurement standards apply to everything the grant buys. Nonprofits are required to have and use their own written procurement procedures, and those procedures have to conform to the federal standards, including full and open competition. Two thresholds moved on October 1, 2025: the federal micro-purchase threshold rose to $15,000 and the simplified acquisition threshold rose to $350,000. Both apply to subrecipient purchases made on or after that date, including purchases under awards issued earlier.
Environmental and historic preservation review. Federal law requires EHP review to be completed before federal funds are released for a project. All construction and renovation work requires it, and installation of certain equipment can trigger it. Where a project may need a full environmental assessment, it has to be identified to FEMA within six months of the award, and completed review materials are due no later than 12 months before the period of performance ends. EHP is the workstream most likely to consume a year of your window without anyone noticing until it is late.
Property and inventory. Equipment purchased with federal funds is subject to property management and disposition rules that continue past the end of the grant. What you bought, where it is, and whether it is still being used for the funded purpose all remain answerable questions.
Records. Specifications, solicitations, competitive quotes, the basis for selection decisions, purchase orders, contracts, invoices, and cancelled checks all have to be retained. The retention period runs three years from the date the final financial report is submitted, which means the file has a life of its own after the project is finished.
How the money actually moves
NSGP is a reimbursement program. Your organization pays the vendor, documents the payment, and requests reimbursement through the SAA. The gap between paying and being repaid is real, it varies by state, and it is a cash flow question your finance lead should be asked about before the subaward is signed rather than after.
Two related points that catch organizations out.
Subrecipients cannot claim pre-award costs. Not with approval, not with justification. Anything spent before the period of performance begins is your organization’s cost, including the work of preparing the application itself, which the program specifically does not fund.
There is no cost share requirement for NSGP at the federal level, so no match to document. Some state programs are different.
One thing in your favor: the program contemplates that administering an award costs money. Nonprofit subrecipients may use up to 5% of each subaward for management and administration. If your organization holds more than one subaward, that has to be accounted for separately for each. Any outside support you contract for has to be procured under the same federal procurement standards as everything else.
Closeout is a 90-day window
This one is worth stating plainly because it is widely misunderstood.
Subrecipients are required to submit closeout materials within 90 calendar days of the end of the subaward period of performance. The 120-day figure that appears in most federal guidance is the recipient’s deadline, meaning the SAA’s deadline to FEMA. Your 90 days is a separate requirement, not a shortened version of the 120.
In practice the effective window is shorter still, because the SAA needs time to review what you submit before assembling its own closeout. Many states set internal deadlines well inside the 90 days.
After closeout, the record retention clock starts. If your organization expends $1,000,000 or more in federal awards in a fiscal year, a single audit is required. Most NSGP-only awardees are below that, but organizations running several federal grants at once should be adding them up rather than assuming.
What this costs in staff time
Post-award management is not a large amount of work in any given week. It is a small amount of work every week for three years, arriving on deadlines set by someone else, and requiring familiarity with rules that change between cycles.
That profile is a poor fit for how most nonprofits are staffed. The award lands on an executive director, an operations director, or a business manager who is already at capacity, and who will be at capacity for the entire 36 months. The work does not fail dramatically. It slips, and then it slips again, and the consequences appear at the mid-cycle check-in or at closeout.
Federal monitoring is also real. FEMA and the SAA have the right to review records, conduct desk reviews, and make site visits during the award. The question at that point is not whether the security work was good. It is whether the file supports it.
What this means for your organization
If you have an award or expect one, the useful move is to decide early who owns the administration and whether that person actually has the hours. Read the subaward agreement rather than the federal guidance, because the subaward is what binds you. Budget for the administrative cost inside the 5% the program allows for it. And treat EHP and procurement as long-lead items rather than paperwork to handle when you get to them.
This is the part of the grant SGA is built to carry. We manage the post-award lifecycle for awardees across 15 or more states, which means we already know how each SAA runs its reporting, what its deadlines actually are, and where the review points fall. The project lead stays on operations. The compliance work still gets done, on time, in a file that holds up.
Not sure where your organization stands? We’re glad to walk through it with you.
If you want a review of where your current award stands, what is on time, and what is at risk, book a free consultation with SGA here or call (855) 674-7946.
Official Sources
Every claim in this guide traces back to a primary federal source. Confirm the current requirements at the URLs below for your specific cycle and SAA.
- FEMA Nonprofit Security Grant Program (NSGP): https://www.fema.gov/grants/preparedness/nonprofit-security
- FEMA Environmental and Historic Preservation (EHP) review: https://www.fema.gov/grants/tools/environmental-historic-preservation
- 2 CFR Part 200 (Uniform Guidance for federal awards): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
- SAM.gov (Unique Entity Identifier registration): https://sam.gov/
- SAM.gov Exclusions (federal debarment search): https://sam.gov/content/exclusions
- Grants.gov opportunity portal: https://www.grants.gov/
- U.S. Department of Homeland Security: https://www.dhs.gov/
State Administrative Agencies publish state-specific post-award guidance and portal instructions. Confirm the SAA contact for your state through the FEMA grants portal above.