The Nonprofit Security Grant Program (NSGP) award notice is not the finish line. It opens a 36-month period of performance with five parallel workstreams, monitored by the Federal Emergency Management Agency (FEMA) and the State Administrative Agency (SAA) against 2 CFR Part 200. Organizations that treated the application as the hard part often discover post-award management is where awards get clawed back, audited, or partially de-obligated.
This roadmap sequences the full lifecycle from acceptance to closeout. Each workstream has its own guide on this site; this article is the overview. The official program page is at FEMA (https://www.fema.gov/grants/preparedness/nonprofit-security) and federal post-award compliance is governed by 2 CFR Part 200 (https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200).
The Award Notice Opens a Three-Year Clock With Five Workstreams Running in Parallel
The SAA award letter confirms the amount obligated, the period of performance (typically 36 months from the federal award date), and the conditions of award. Reading the conditions is the first post-award task: reporting cadence, EHP requirements if triggered, allowable cost categories, and pre-procurement clearances specific to the cycle.
From acceptance forward, five workstreams run until closeout:
- Drawdown. Submitting reimbursement requests to the SAA after payment is made and documentation is complete.
- Performance reporting. Quarterly or semi-annual narrative reports describing progress against the funded scope.
- Financial reporting. Federal Financial Reports (SF-425) on the cadence the SAA requires.
- Environmental and Historic Preservation (EHP) review. Required for any project with ground disturbance, exterior modification, or work on a historic structure. EHP must clear before procurement begins on the triggering line items.
- Closeout. The final 120 days under the federal default (2 CFR 200.344, revised October 2024), during which the final financial report, final performance report, and asset disposition record are filed. Some SAAs shorten this window to 90 days.
These workstreams overlap. A multi-site awardee may be drafting an EHP package for one facility, submitting a reimbursement for another, and writing a performance report on the third in the same week. The roadmap below sequences them by phase, but the parallel nature is the operational reality.
The Five Post-Award Workstreams
Each workstream has a separate dedicated guide on this site. The summaries below are entry points, not deep dives.
Drawdown. Reimbursement requests go to the SAA portal after the awardee has paid the vendor and assembled invoice, proof of payment, budget line mapping, procurement file, and EHP clearance if applicable. Portals differ by state. The awardee pays first and waits 30 to 90 days for reimbursement. See the dedicated guide on NSGP reimbursement for submission mechanics.
Performance reporting. Quarterly (federal) or semi-annual (some state programs) narratives describe what was procured, installed, trained, and how the funded work maps to the original Investment Justification (IJ). Late or thin reports pause drawdown.
Financial reporting. The SF-425 Federal Financial Report tracks obligations, expenditures, and unliquidated balances. Federal cadence is typically semi-annual with an annual report layered on top. The SAA confirms the exact schedule in the conditions of award. Late SF-425s are an audit finding on their own.
EHP review. The Environmental and Historic Preservation review (https://www.fema.gov/grants/tools/environmental-historic-preservation) is required when funded work touches the ground (bollards, fencing footings, lighting trenches), modifies the exterior (cameras on facades, hardened doors visible from the public way), or affects a historic structure. EHP must clear before the affected line item is procured. See the dedicated guide on FEMA EHP review.
Closeout. The final 120 days after the period of performance ends under the federal default (2 CFR 200.344, revised October 2024). FEMA NSGP SAA windows historically used 90 days; the current cycle-specific deadline appears in the SAA closeout instructions. Final SF-425, final performance report, asset disposition record, and equipment inventory all go to the SAA. Records have to be retained three years from submission of the final expenditure report under 2 CFR 200.334. See the dedicated guide on closing out an NSGP award.
Months 0-6: Award Acceptance and Setup
The first six months are administrative. Procurement of long-lead items begins toward the end of this window. The work here prevents problems for the next 30 months.
Sign and accept the award. The SAA sends the subaward agreement, typically within 60 to 90 days of the federal award announcement. Accepting requires an authorized signatory. Some states require a board resolution before signature.
Confirm SAM.gov registration is active. Federal awards require active registration at https://sam.gov/ throughout the period of performance. SAM registration expires annually. A lapse freezes drawdown immediately. Set a calendar reminder for SAM renewal 60 days before expiration every year.
Build the project binder. Federal awards live or die on file structure. A clean binder, physical or digital, has folders for award documents, conditions of award, SAM and UEI records, procurement files (one per purchase), EHP files (one per triggering line item), drawdown requests, performance reports, financial reports, and SAA correspondence. Reconstructing this under audit pressure is not realistic.
Identify EHP triggers in the budget. Bollards in the ground trigger EHP. Cameras drilled into an exterior wall may trigger EHP depending on the structure. Lighting on existing poles typically does not. Flag triggered items and start the EHP package early. EHP can take 60 to 180 days for FEMA to clear.
Solicit current vendor quotes. The IJ budget used pricing 9 to 18 months out of date by the time the award is accepted. Material costs for steel, electronics, and labor move enough between budget and award to require formal budget modifications if the gap exceeds 10 percent of any line.
Kickoff with the SAA. Some SAAs run mandatory post-award orientation; others offer it on request. Attending pays for itself in avoided drawdown rejections.
Months 6-18: Active Procurement and Drawdown
This is the heaviest phase operationally. EHP clearances come in, procurement files are built, equipment is installed, and the first drawdowns are submitted.
Run procurement under 2 CFR Part 200. Federal procurement rules apply. The micro-purchase, small purchase, and formal sealed bid thresholds each have documentation requirements. Sole-source procurement requires written justification accepted by the SAA. See the dedicated guide on NSGP procurement for thresholds and file structure.
Check vendors against SAM exclusions. Every vendor over the micro-purchase threshold must be confirmed as not federally debarred. Run the SAM exclusions search at https://sam.gov/content/exclusions and save the dated screenshot. A vendor with an active exclusion makes the entire purchase unallowable.
Submit the first drawdown early. The first reimbursement request almost always comes back with corrections. Submitting it early, even for a small allowable cost like initial training, surfaces the corrections before larger procurement reimbursements queue up.
File performance reports on time. Even when little has changed, the report has to be submitted on schedule. “EHP package submitted for bollards, awaiting clearance” is an acceptable status when it reflects reality. Silence is not.
Modify the budget when material. Budget modifications above 10 percent of any line, or any reallocation between approved categories, typically require SAA approval before the spend. Spending first and modifying later is a finding.
If you have just received an NSGP award and your team has never run the drawdown-reporting-closeout cycle, the first 60 days set the tone for the next three years. SGA runs post-award onboarding for first-time awardees covering binder build, SAM verification, EHP triage, and the first drawdown. Book a free consultation with SGA here.
Months 18-30: Mid-Cycle Reporting and Performance Reviews
By month 18, most awardees should have spent or obligated 40 to 60 percent of the award. SAAs run mid-cycle check-ins around this point, looking at burn rate, performance progress, and whether the period of performance will absorb the remaining funds.
Burn rate review. If less than 30 percent of the award has been spent by month 18, the SAA may flag the project for technical assistance or a future de-obligation conversation. The remedy is documented procurement activity in the next quarter, not optimistic language in the next report.
Mid-cycle site visit. Some SAAs conduct site visits in this phase to confirm purchased equipment is installed, used as scoped, and inventoried correctly. The project binder and equipment inventory get reviewed.
Equipment inventory. Every item with a per-unit cost above $10,000 (the federal equipment threshold raised from $5,000 under the October 2024 OMB revision to 2 CFR 200.1, or the lower threshold the SAA sets) goes on the inventory with manufacturer, model, serial number, location, date placed in service, and federal share percentage. Maintain it continuously, not at closeout.
Training and exercise documentation. If the award funded training or tabletop exercises, rosters, agendas, and after-action reports get filed and summarized in the performance report. Undocumented training cannot be claimed.
Plan for the final year. Items not procured by month 24 need a hard timeline. Long lead items (custom doors, integrated access control, specialized barriers) may already be too late for installation within the period of performance. The no-cost extension conversation, if needed, starts in this phase, not in month 35.
Months 30-36: Closeout
The final six months wind the award down. Procurement, installation, and the final drawdown all have to complete before the period of performance ends, because costs incurred after that date are unallowable.
Final procurement and installation. All vendor work has to be complete and invoiced before the period of performance ends. A common failure is approving a purchase order in month 35 and discovering the vendor’s lead time runs past month 36. The unliquidated obligation is not allowable.
Final drawdown. The last reimbursement request goes in with enough lead time for SAA review and corrections. Submitting on the last day of the period of performance is operationally risky.
Final performance report. The closeout report summarizes everything procured, installed, trained, and exercised against the original IJ. Thin closeout reports trigger follow-up that delays the closeout itself.
Final SF-425 and asset disposition. The final financial report reconciles obligations and expenditures (unliquidated balance must be zero). The asset disposition record documents the federal share of equipment above the inventory threshold and any disposition plan if equipment leaves federal-share use within the useful life.
Records retention. Records have to be retained three years from the date of the final SF-425 under 2 CFR Part 200.334. See the dedicated guide on closing out an NSGP award for the 90-day closeout checklist.
Roles: Who Does What Internally
Post-award management is not a one-person job. Organizations that close out cleanly have four roles staffed, even if some are combined.
Project lead (grants manager or equivalent). Owns the calendar, the binder, the SAA relationship, and the deadlines. Drafts performance reports, routes drawdowns through finance, and triages EHP and procurement questions. In organizations without a grants manager, this falls on the executive director or operations director, who is usually already overcommitted.
Finance lead. Owns the SF-425, the general ledger mapping to the award, the cash-flow plan for the gap between vendor payment and SAA reimbursement, and the audit trail. Files proof of payment for every drawdown. In small nonprofits, this is the bookkeeper plus the treasurer.
Security committee or facilities lead. Owns vendor relationships, installation supervision, the equipment inventory, and the training calendar. Confirms that what was scoped in the IJ is what is actually being installed.
Board oversight. The board does not run the award but accepts fiduciary responsibility for federal funds. A standing quarterly agenda item reviewing burn rate, upcoming deadlines, and SAA correspondence keeps the board in position to act if the project drifts.
The most common failure pattern is the project lead being a part-time role assigned to someone already running operations, programs, or development. Deadlines arrive on schedule whether or not anyone has time for them.
Common Post-Award Failures That Trigger Audit Findings
These patterns recur across SAA monitoring reports and federal Office of Inspector General audits of NSGP and similar preparedness grants.
-
Lapsed SAM registration. Drawdown freezes immediately. The fix takes 7 to 21 business days.
-
Procurement without competition. Above the micro-purchase threshold, undocumented competition is unallowable. Reimbursements already drawn down may have to be returned.
-
EHP-triggering work started before clearance. Pouring concrete for bollards before EHP clears is unallowable. The full line item, including materials, can be disallowed.
-
Equipment inventory missing or incomplete. Auditors test inventory by walking the site and asking to see specific items. Missing items or memory-built inventory both trigger findings.
-
Performance reports submitted late or skipped. Each missed report is a finding. Patterns of late reporting affect future-cycle competitiveness.
-
Costs incurred outside the period of performance. Pre-award costs and post-end costs are unallowable without explicit FEMA approval.
-
Sole-source procurement without written justification. “We always use this vendor” is not justification. Sole source requires documented analysis showing no other vendor can meet the scope.
-
Cost categories misaligned with the NOFO. Moving funds between approved categories without SAA approval is a finding even when the total stays within budget.
-
Mission drift. Procuring items outside the original IJ scope, even when allowable on paper, requires a budget modification and SAA approval first.
-
Records destroyed before the retention period ends. The three-year clock starts at final SF-425 submission. Earlier discarded records cannot be produced under audit.
Frequently Asked Questions
How long after the award letter can drawdown start?
Drawdown starts after the subaward agreement is signed, the SAA portal access is provisioned, and the first allowable cost has been paid and documented. For most awardees, the first eligible drawdown is in month 3 to month 6. Pay vendors out of operating cash and reimburse from the SAA is the standard model. Organizations without 60 to 90 days of operating cash to float the gap should raise this with the SAA before signing.
What happens if the award cannot be spent within 36 months?
The awardee can request a no-cost extension from the SAA, which the SAA may forward to FEMA. Extensions are typically granted for 6 to 12 months with documented justification (vendor delays, EHP timeline, supply chain). The request has to be made before the period of performance ends, ideally 90 days before. Unspent funds at the end of an unextended period of performance are de-obligated.
Can equipment purchased with NSGP funds be sold or repurposed?
Equipment with a per-unit cost above the federal threshold (currently $10,000 since the October 2024 OMB revision to 2 CFR 200.1, unless the SAA sets a lower threshold) is subject to disposition rules under 2 CFR Part 200.313. During the useful life, equipment has to remain in use for the funded purpose. After the useful life, or earlier with SAA approval, disposition may occur and the federal share may be owed back depending on fair market value. Selling or repurposing without SAA approval is a finding.
Do volunteer hours count as match?
NSGP at the federal level does not require match, so volunteer hours are not material for federal-only awards. Some state programs do require match, with state-specific documentation rules. Where required, volunteer hours typically count at a documented rate per hour with sign-in sheets and task descriptions on file.
Is a single audit required after an NSGP award?
Under 2 CFR Part 200 Subpart F, organizations that expend $1,000,000 or more in federal awards in a fiscal year are required to obtain a single audit (the threshold rose from $750,000 for fiscal years beginning on or after October 1, 2024). NSGP expenditures count toward the threshold. Many NSGP-only awardees fall below it, but the SAA may still conduct monitoring reviews. Awardees with multiple federal grants should sum expenditures to confirm.
What We Do
Security Grant Advisors runs post-award management for NSGP awardees end to end. The engagement covers drawdown submissions, performance reports, SF-425 financial reports, EHP package preparation, procurement file structuring under 2 CFR Part 200, equipment inventory, and the full 90-day closeout.
If your organization has been awarded NSGP and you do not have a grants manager on staff, or you have one stretched across multiple federal awards, SGA handles the lifecycle so the project lead can stay on operations. We work on three-year retainers aligned to the period of performance or on per-milestone engagements (onboarding, mid-cycle reset, closeout). Multi-site awardees and organizations running parallel federal and state awards are a frequent fit.
If you want a review of where your current award stands, what is on time, and what is at risk, book a free consultation with SGA here or call (855) 674-7946.
Official Sources
Every claim in this guide traces back to a primary federal source. Confirm the current requirements at the URLs below for your specific cycle and SAA.
- FEMA Nonprofit Security Grant Program (NSGP): https://www.fema.gov/grants/preparedness/nonprofit-security
- FEMA Environmental and Historic Preservation (EHP) review: https://www.fema.gov/grants/tools/environmental-historic-preservation
- 2 CFR Part 200 (Uniform Guidance for federal awards): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
- SAM.gov (Unique Entity Identifier registration): https://sam.gov/
- SAM.gov Exclusions (federal debarment search): https://sam.gov/content/exclusions
- Grants.gov opportunity portal: https://www.grants.gov/
- U.S. Department of Homeland Security: https://www.dhs.gov/
State Administrative Agencies publish state-specific post-award guidance and portal instructions. Confirm the SAA contact for your state through the FEMA grants portal above.