Most Nonprofit Security Grant Program (NSGP) applications that fail do not fail because the narrative was weak. They fail because something mechanical was wrong with the submission package before any reviewer ever scored a sentence. The State Administrative Agency (SAA) runs an administrative review first. Packages that miss a registration, a signature, a document, a deadline, or a character cap are rejected at that gate and never reach scoring at all.
The ten mistakes below are the ones that account for most of those administrative rejections, plus a handful of preventable scoring losses tied to template and document discipline rather than narrative quality. Each one is fixable in the days before the SAA portal closes. None of them require rewriting the Investment Justification (IJ).
This article covers the mechanical errors applicants control. For scoring and narrative reasons strong IJs still end up below the funded line, see the companion article on why NSGP applications get denied at the panel-scoring stage.
Mistake 1: Expired SAM.gov UEI on Submission Date
Every NSGP applicant needs an active Unique Entity Identifier (UEI) issued through SAM.gov (https://sam.gov/). The UEI replaced the prior DUNS number in April 2022. It is the single registration most often expired on the day a credible application is submitted.
UEI registrations expire annually. The expiration date is tied to the original registration date, not the federal fiscal year and not the NSGP cycle. An organization that registered in September will expire in September regardless of where that falls in the application calendar. Nonprofits that registered once for a prior NSGP cycle, never drew down (denied applicants), and let the entity lapse find out the UEI is inactive only when the SAA portal rejects the upload.
What to do:
- Pull the SAM.gov record at least eight weeks before the SAA deadline
- Confirm the expiration date is after the SAA deadline by at least 90 days
- If expiration falls inside that window, renew immediately; renewals can take ten to fifteen business days when the IRS Form W-9, banking details, and authorized representative documents are clean
- Save the renewal confirmation; SAA reviewers occasionally ask for it during administrative review
A separate but related check: confirm the organization does not appear on the SAM.gov exclusions list (https://sam.gov/content/exclusions). Federally debarred entities cannot receive NSGP funds, and the SAA verifies this independently.
Mistake 2: Missing or Lapsed SAA Prequalification
Several states require a separate prequalification process before any state grant submission is accepted. New York is the strictest. New York nonprofits must be prequalified in the Statewide Financial System (SFS) before the New York SAA accepts a single NSGP document. First-time prequalification takes six to ten weeks. Prequalification expires and must be renewed; an expired prequalification on the submission date is treated as no prequalification at all.
Other states with analogous requirements:
- California: Office of the Attorney General Registry of Charitable Trusts filing must be current; nonprofits that missed the prior annual filing are blocked
- New Jersey: Charities Registration with the Division of Consumer Affairs must be current
- Illinois: GATA (Grant Accountability and Transparency Act) prequalification through the state portal
- Massachusetts, Pennsylvania, Maryland, and others: state-specific charity-bureau or grants-portal status checks
What to do:
- Check the SAA bulletin for the current cycle and identify every state-level prequalification that applies
- Run the status check on the state portal at least eight weeks before the SAA deadline
- For New York applicants, treat SFS prequalification as a fixed six-to-ten-week pre-work item; do not start the IJ until prequalification is filed
- Save prequalification confirmation screenshots; SAA staff sometimes request proof when portal records lag
Prequalification problems are the single most common reason credible New York applications never reach scoring. The SAA does not waive the requirement for grant deadlines.
Mistake 3: Wrong Stream Selected (NSGP-UA vs NSGP-S)
NSGP funds two streams: NSGP-Urban Area (NSGP-UA) for facilities inside FEMA-designated Urban Area Security Initiative (UASI) regions, and NSGP-State (NSGP-S) for facilities outside UASI regions. Each state SAA runs both streams in parallel. The streams are scored separately and funded from separate appropriations.
Selecting the wrong stream is a mechanical rejection. The SAA does not move a misclassified application from one pool to the other; it returns the package with instructions to resubmit under the correct stream, often after the deadline has passed.
Common errors:
- A facility in a suburb adjacent to a UASI city assumed to be inside the UASI region without checking the official boundary
- A multi-site applicant submitting all facilities under one stream when some addresses are inside the UASI and some are outside (these belong in separate IJs in separate streams)
- A facility that moved during the prior year submitted under the stream that matched the old address
- A facility inside a UASI region submitted under NSGP-S because internal staff believed NSGP-S had higher funding odds
What to do:
- Verify each facility address against the current FEMA UASI list, published with the NOFO on https://www.fema.gov/grants/preparedness/nonprofit-security
- For multi-site applicants, classify each address before drafting any IJ
- For borderline addresses, contact the SAA in writing for confirmation and save the response
Stream selection is also covered in the companion article on NSGP-S vs NSGP-UA, which goes deeper on the cross-stream multi-site mechanics.
Mistake 4: IJ Submitted on an Outdated Template
FEMA revises the Investment Justification template between cycles. The 2024 template, the 2025 template, and the 2026 template are not interchangeable. Section ordering, character limits, header labels, and required attachments shift year to year. The 2025 cycle introduced changes to the Risk and Vulnerability sections that the 2024 template did not contain. The 2026 NOFO retained the 2025 structure with minor relabeling.
Applicants who download an old template from an internal folder, a prior consultant’s file share, or a peer organization’s saved package risk submitting on a template that no longer matches what the SAA expects. SAA administrative review flags template mismatches because the section headers do not line up with the current scoring rubric.
What to do:
- Download the IJ template directly from the current FEMA NOFO page (https://www.fema.gov/grants/preparedness/nonprofit-security) or through the federal grants portal at https://www.grants.gov/
- Confirm the template version date matches the current NOFO
- Discard any prior-cycle templates from internal folders; rename them as archive if retention is needed
- Cross-check that the SAA has not issued a state-specific overlay template (a few states do)
A passable IJ on the wrong template still gets rejected at administrative review. The fix takes hours, not weeks, but only if caught before the SAA deadline.
Mistake 5: Character-Count Overruns
Every scored section of the IJ has a hard character cap. The 2025 and 2026 cycles cap Background at 1,500 characters and each of the four scored sections (Risk, Vulnerability, Consequences, Effect of Funding) at 5,000 characters. Characters include spaces, line breaks, and punctuation.
The portal does not warn when a section exceeds the cap. It truncates the section at the limit and saves the truncated version. The applicant sees the full draft on the local document but the reviewer sees the cutoff version. Reviewers who hit a mid-sentence cutoff score the section as written, not as intended.
Common patterns that produce overruns:
- Pasting from a Word document with smart-quotes and em-dashes that expand into multiple characters on paste
- Copying section drafts from a prior cycle without recounting against the current cap
- Adding a final citation block that pushes the section past 5,000
- Combining the Background and Risk sections in the local draft and pasting both into the Risk field
What to do:
- Draft every section in a plain-text editor with a live character counter
- Target 4,950 of 5,000 characters in the scored sections to leave room for last-minute citation additions
- Convert smart quotes and em-dashes to plain ASCII before pasting
- Preview each section in the SAA portal after pasting and compare on-screen text against the local draft
- Save a screenshot of each section as submitted; if the portal truncated, the screenshot is the only record of what the reviewer actually saw
A section submitted at 4,999 of 5,000 characters loses nothing. A section that hit 5,000 in the local file and continued for another sentence is truncated without a warning the applicant ever sees.
If your application is days away from the SAA portal deadline and you want a 48-hour pre-submission review that catches every one of these mistakes before the submit button, we run rapid pre-submission audits. Book a free consultation with SGA here.
Mistake 6: Missing 501(c)(3) IRS Determination Letter
Every NSGP application requires the IRS 501(c)(3) determination letter as a supporting document. The letter must be the official IRS-issued document, not a state tax-exemption certificate, not a charity bureau registration, and not an internal board resolution.
Three patterns produce this rejection:
- The organization cannot find the original letter and submits a printout of the IRS Tax Exempt Organization Search page in its place; SAAs reject the substitute
- The organization operates under a group exemption (common for denominational structures, religious orders, and federations) and submits the umbrella organization’s letter without the supplementary group ruling documentation
- The organization changed its legal name through restated articles and submits the old letter; the SAA flags the name mismatch against the SAM.gov record
What to do:
- Locate the original IRS determination letter (look in the founding-document binder, with the corporate attorney, or in prior 990 backup files)
- If the original is lost, request a determination letter affirmation from the IRS using Form 4506-B (a free request, processed in 30 to 60 days; start the request months before the cycle, not during)
- For group exemption members, contact the parent organization for the current group ruling letter and the supplementary letter naming the applicant
- For name changes, prepare a clean documentation trail: amended articles, IRS name-change notification, and current letter under the new name
The 501(c)(3) gate is one of the three pre-application registrations covered in the eligibility article. Missing this document is an automatic administrative rejection, not a score deduction.
Mistake 7: Missing or Unsigned Vendor Quotes
NSGP applications include a detailed budget with line items, unit costs, and vendor quotes supporting each line. The budget is not scored independently in most cycles, but vendor quotes are required as supporting documentation. Missing or invalid quotes trigger administrative flags and produce score loss in the Effect of Funding section when reviewers cannot verify that proposed equipment is actually procurable at the stated price.
Common vendor-quote failures:
- Quotes on letterhead but unsigned (some SAAs accept; others reject)
- Quotes dated more than 90 days before submission (vendors typically honor quotes for 30 to 90 days; expired quotes raise procurement-feasibility questions)
- Quotes for products that do not match the IJ description (the IJ specifies ASTM F2656 M30 bollards; the quote is for decorative steel posts with no rating)
- A single quote for an item over the small-purchase threshold (procurement under 2 CFR Part 200 requires competition above defined thresholds; a single quote signals procurement risk)
- Quotes that exclude installation, shipping, or warranty when the IJ budget claims installed cost
What to do:
- Solicit three quotes per major line item, even when only one will be submitted in the package
- Confirm each quote is dated within 90 days of the SAA deadline
- Confirm each quote specifies make, model, rating, and installed-or-not status
- Ask the vendor to sign and date the quote on letterhead
- Attach quotes in the budget package in the order the budget line items appear, with file names that reference the line
The procurement file the awarded organization will build during the period of performance starts here. Sloppy quotes at application become sloppy procurement at drawdown.
Mistake 8: Vulnerability Assessment Without Photos
Federal NSGP accepts vulnerability assessments without photographs. Several state programs do not. New Jersey, Pennsylvania, Maryland, and a handful of others require photographic documentation of access points, current security posture, and identified gaps as part of the state-administered submission.
Applicants who reuse a federal-style assessment without photos for a state program that requires them get the package rejected at state administrative review. The remedy is a site walkthrough with a camera, which takes a day in the field plus a day to annotate and place the photos. It is not a long fix. It is fatal when discovered the day before the deadline.
What to do:
- Read the SAA bulletin for photo requirements before drafting the assessment
- For state programs that require photos, schedule the site walkthrough at the start of the assessment work, not the end
- Photograph every access point, every identified gap, and every adjacent context shot the assessment cites
- Caption each photo with the access point number, date, and finding it supports
- Embed photos inline with the relevant finding; do not append them as a separate gallery the reviewer has to flip back to
The vulnerability assessment is covered in depth in the dedicated checklist article. Photo discipline is one of the items that separates a federally-acceptable assessment from a state-program-acceptable assessment.
Mistake 9: Late Submission to the SAA Portal
The deadline applicants need to meet is the State Administrative Agency deadline, not the FEMA deadline. SAA deadlines always precede the FEMA deadline (the SAA needs time to rank submissions and forward the top scorers to FEMA). Most SAA deadlines fall two to four weeks before the FEMA cutoff.
Applicants who read the FEMA NOFO date and plan to that deadline miss the SAA deadline by weeks. The SAA portal closes at the stated time, in the stated time zone, and does not extend for technical issues on the applicant side. Portal issues on the SAA side occasionally produce official extensions; the SAA announces those by bulletin and never grants them informally to individual applicants.
Common late-submission patterns:
- Applicant reads the FEMA date, works the IJ to that date, and discovers the SAA closed three weeks earlier
- Applicant plans to submit on the SAA deadline day at 4:55 PM; portal slowness or a final attachment upload error pushes past 5:00 PM
- Applicant submits in the correct time zone for the organization headquarters but the SAA portal runs on a different state time zone
- Applicant submits the package but a required attachment failed to upload; the SAA system records the submission as incomplete
What to do:
- Confirm the SAA deadline for the current cycle directly from the state SAA bulletin, not from federal sources
- Build the submission plan to a target date 72 hours before the SAA deadline
- Submit the full package by the target date; reserve the final 72 hours for portal verification and one corrective resubmission if anything fails
- Confirm the SAA portal time zone in the bulletin
- After submission, download the SAA submission receipt and verify every attachment appears in the receipt list
The 72-hour buffer is the single change that converts most last-minute rejections into clean submissions.
Mistake 10: Skipped State-Specific Cover Documents
Federal NSGP has a defined submission package: IJ, vulnerability assessment, mission statement, budget detail, 501(c)(3) letter, SAM.gov UEI proof, and the standard federal forms. State SAAs add cover documents on top of that package. The state-specific layer is often where credible federal-quality submissions get rejected at administrative review.
Examples of state-specific cover documents:
- New York: Vendor Responsibility Questionnaire (VendRep), Contractor Certification, Lobbying Compliance Form
- California: state-specific certifications under Cal OES grant programs
- Illinois: GATA Uniform Application, Uniform Grant Agreement
- New Jersey: state procurement disclosures and supplementary nonprofit certifications
- Pennsylvania, Maryland, Texas, Florida, and others: each maintains a state-specific checklist published with the SAA bulletin
Federal-program-only applicants who treat the state SAA as a pass-through (assuming the state simply forwards the federal package) miss the state layer entirely.
What to do:
- Download the current state SAA bulletin and pull the state-specific checklist
- Treat the state checklist as binding alongside the federal NOFO; both apply
- For multi-state applicants (organizations applying to NSGP federal and a state program in parallel), build separate document maps for each program
- Confirm with the SAA in writing if any state document appears ambiguous; save the response
State NSGP-style programs include NY SCAHC, CA CSNSGP, NJ NSGP, IL NSGP-IL, PA NSGFP, MA CNSGP, CT NSGP, AZ NSGP, MD PAHC, OH OSG, TN HOW, WA NROSGP, GA FPC, and CO NSGP. Each maintains a distinct cover-document set. The federal U.S. Department of Homeland Security (https://www.dhs.gov/) publishes the umbrella preparedness framework, but state SAAs administer the actual submission portals and define the local requirements.
The Difference Between Mechanical Errors and Scoring Issues
The ten mistakes above all share one quality: they cause rejection at administrative review, before any scoring panel reads the IJ narrative. They are mechanical errors, not narrative errors. Fixing them does not improve the score; it makes scoring possible at all.
Scoring-side denials are different. An application that passes administrative review, reaches the SAA scoring panel, and then the FEMA panel can still score below the funded line for reasons tied to narrative quality: weak risk documentation, vague vulnerability findings, generic consequence language, or a broken effect-of-funding chain. Those reasons are covered in the companion article on why NSGP applications get denied at the scoring stage. The scoring rubric itself is covered in the NSGP scoring criteria article. The appeal pathway after a scored denial is covered in the appeal article.
For applicants in the final weeks before submission, the question is sequencing. Mechanical errors are caught and fixed in days. Narrative weaknesses take weeks to address well. Both have to be clean for an application to fund. Most applicants underinvest in the mechanical checklist because the IJ feels more important. Reviewers never see the IJ if the checklist fails.
Frequently Asked Questions
If we discover an expired UEI three days before the SAA deadline, can we still submit?
The SAA portal will reject any package with an inactive UEI. Renewal in three business days is not realistic; SAM.gov renewals take ten to fifteen days when records are clean and longer when they are not. The only practical move at three days out is to file an expedited renewal request through SAM.gov customer service while preparing to withdraw the application this cycle and re-apply in the next. Applicants who catch the expired UEI at eight weeks out have time to renew without disruption.
Our state SAA has not posted the 2026 bulletin yet. Can we submit using last year’s checklist?
No. State bulletins shift cover-document requirements every cycle. Drafting against last year’s checklist risks missing a new form or submitting on a retired one. The bulletin posts when the SAA opens the portal, usually within two weeks of the federal NOFO release. Until the bulletin is posted, focus on the federal items (IJ template, vulnerability assessment, 501(c)(3) letter, SAM.gov UEI) and confirm state-specific items when the bulletin lands.
We submitted on what we believed was the correct stream and the SAA returned the package. Can we resubmit on the other stream?
Only if the SAA deadline has not passed. The SAA does not waive deadlines for misclassified resubmissions. If the original submission was made well before the deadline (which is the argument for the 72-hour buffer), resubmission on the correct stream is possible. If the original was made at the deadline, the resubmission window is gone and the application is out for the cycle.
Do photos in the vulnerability assessment hurt a federal-only submission?
No. Federal NSGP does not require photos but accepts them. A photo-supported federal submission reads more credibly than a text-only one and aligns the assessment with state-program requirements if the organization later applies in parallel. The marginal cost of adding photos at the federal level is low and the upside is consistent across program types.
If our SAA portal goes down on the deadline day, do we get an extension?
Only the SAA can grant extensions, and only when the SAA confirms its own system failure. Extensions are announced by official bulletin, never by phone call to individual applicants. Documented portal failures on the applicant side (internal IT issues, attachment upload errors, slow connections) do not produce extensions. The 72-hour buffer exists for this reason.
What We Do
Security Grant Advisors runs pre-submission reviews for nonprofits in the final stretch of an NSGP cycle. The review checks SAM.gov UEI status, SAA prequalification, stream selection against the current UASI list, IJ template version, character counts in every scored section, 501(c)(3) documentation, vendor-quote completeness, vulnerability assessment photo discipline, SAA deadline alignment, and the state-specific cover-document checklist.
The review produces a written report with each item flagged green, yellow, or red, plus a fix list ordered by deadline urgency. Items in the red column are fixed before submission; items in yellow are documented for the post-submission record.
If your nonprofit is preparing an NSGP application for the current cycle and wants a specialist to run a final pre-submission review against the most common rejection triggers (administrative completeness, character limits, template adherence, supporting document checklist, SAA-specific cover requirements), SGA runs 48-hour pre-submission reviews up to the day before the deadline. You can book a free consultation with SGA here.
Official Sources
Confirm the current cycle requirements at the official URLs below before submission. Each link goes to the primary federal source; state-specific bulletins are published by each State Administrative Agency.
- FEMA Nonprofit Security Grant Program (NSGP): https://www.fema.gov/grants/preparedness/nonprofit-security
- Grants.gov opportunity portal: https://www.grants.gov/
- SAM.gov (Unique Entity Identifier registration): https://sam.gov/
- SAM.gov Exclusions (federal debarment search): https://sam.gov/content/exclusions
- U.S. Department of Homeland Security: https://www.dhs.gov/
- 2 CFR Part 200 (Uniform Guidance for federal awards): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
State Administrative Agencies publish state-specific NOFOs, bulletins, and submission portals. Confirm the current SAA contact and the state-specific cover-document checklist for your state through the FEMA grants portal above.