Nonprofit Security Grant Program (NSGP) funding is restricted. Every dollar spent under an NSGP award has to map to one of six allowable cost categories published in the current Federal Emergency Management Agency (FEMA) Notice of Funding Opportunity (NOFO). A budget line that does not cleanly map to one of the six is the most common reason an otherwise strong application is cut at the State Administrative Agency (SAA) administrative review stage before scoring starts.
This guide walks through each category with concrete examples, names the items applicants most often assume are allowable when they are not, and covers how state-program allowability differs from the federal list when nonprofits stack NSGP with a state grant.
The Six NOFO Categories at a Glance
The FEMA NSGP NOFO, published annually at https://www.fema.gov/grants/preparedness/nonprofit-security and posted on https://www.grants.gov/, defines the allowable cost structure. The current FY25 NOFO organizes allowable costs into six categories:
- Planning
- Equipment
- Training
- Exercises
- Contract security personnel
- Management and administration (M&A)
Every budget line item must map to one of these categories, and the budget detail submitted with the Investment Justification (IJ) has to identify which one. SAA administrative staff check the mapping before the IJ is scored. The U.S. Department of Homeland Security oversight role is at https://www.dhs.gov/, and the federal Uniform Guidance governing each category is at https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200.
Category 1: Planning
Planning covers the documents and processes an organization needs to make security investments effective. Allowable planning costs include vulnerability assessment development or refresh (when performed by an outside firm under contract), security plan drafting, emergency operations plans, continuity of operations plans, active threat response plans, evacuation and shelter-in-place plans, training plan development, communication plans, and risk management plans that document how the organization will sustain mitigations after the period of performance ends.
Planning is subject to a percentage cap published in the NOFO. Applicants who load planning beyond the cap have the excess disallowed at award negotiation. Most awarded nonprofits use planning to commission a professional vulnerability assessment for the next cycle or to formalize an emergency operations plan that integrates the funded equipment.
Category 2: Equipment
Equipment is the largest spending category for most NSGP awardees. The NOFO ties allowable equipment to the FEMA Authorized Equipment List (AEL), which catalogs every item the program will fund and assigns each an AEL number. If an item is not on the AEL, it is not allowable regardless of how directly it addresses a documented vulnerability.
Physical hardening: bollards and vehicle barriers (fixed, removable, crash-rated), reinforced doors and door frames, ballistic-resistant film and glazing, reinforced windows, perimeter fencing and gates, security shutters, and blast-resistant elements where the threat assessment justifies them.
Surveillance: CCTV systems including cameras, network video recorders, and storage; license plate recognition cameras; video management software; monitor stations; and exterior lighting that supports surveillance.
Access control: card readers, key fob and mobile credential systems; electronic door strikes and magnetic locks; intercom and video intercom at controlled entrances; visitor management systems; mantrap entries and security vestibules; and biometric access systems where the threat picture supports them.
Communication: two-way radio systems for security staff and ushers, mass notification systems, panic buttons (hardwired or mobile), emergency communication apps, and integration with local law enforcement dispatch where the agency supports it.
Cybersecurity equipment: firewalls, intrusion detection and prevention appliances, endpoint protection, multi-factor authentication, network monitoring tools, and secure backup systems that isolate critical organizational data.
The cybersecurity category was expanded in recent NOFO cycles and is now a viable line for organizations whose vulnerability assessment identifies the digital perimeter, donor data, or operational technology as a documented gap. Cybersecurity costs cannot be a stand-alone justification; they have to tie back to the same risk and vulnerability narrative as the physical investments. Installation labor for allowable equipment is allowable. Maintenance contracts beyond the period of performance are not.
If you are building a budget for a 2026 or 2027 NSGP application and want every proposed line item mapped to an allowable category before submission, the SAA administrative review will catch any misalignment before scoring even starts. We review budgets against the current NOFO. Book a free consultation with SGA here.
Category 3: Training
Training covers instruction for the people who will use the funded equipment and respond during an incident. Allowable topics include active threat response (run, hide, fight protocols), evacuation procedures specific to the facility, mass casualty response and Stop the Bleed instruction, behavioral threat indicators, security awareness for staff who interact with the public, usher and greeter protocols at houses of worship, volunteer security team training, de-escalation techniques, cybersecurity awareness, emergency communication procedures, and reunification procedures for facilities serving children or vulnerable adults.
The training audience can include paid staff, volunteers, ushers, security team members, board members, clergy, teachers in co-located schools, and congregation or community members in broader awareness sessions. The NOFO does not restrict training to security personnel; it restricts training to topics tied to the documented vulnerability and the funded mitigations.
Allowable cost components: instructor fees, course materials, training space rental when the facility cannot host, travel for instructors when justified, and equipment used during instruction (manikins for Stop the Bleed, scenario props). General organizational development workshops and certifications unrelated to security operations are not allowable.
Category 4: Exercises
Exercises are the structured drills that validate the plans and training the award funded. Three types are commonly funded under NSGP.
Tabletop exercises. A facilitated discussion-based walk-through of an incident scenario with leadership, security team, and key staff. Tabletops validate decision-making, communication paths, and role clarity without physical movement.
Functional exercises. A scenario-driven exercise that activates specific functions (notification, evacuation, lockdown, reunification) without full operational deployment.
Full-scale exercises. A live exercise that simulates an incident with physical movement, mock victims, responder coordination, and integration with local law enforcement and emergency medical services. The most expensive and most complex to coordinate.
Exercises have to follow the Homeland Security Exercise and Evaluation Program (HSEEP) methodology to be reimbursable under NSGP. Allowable costs include design and facilitation fees, controller and evaluator and role player compensation, after-action report development, and materials consumed during the exercise. Exercises that do not produce an after-action report are not reimbursable.
Category 5: Contract Security Personnel
Contract security personnel covers paid security staffing from a licensed third-party vendor. The NOFO permits both armed and unarmed contract security from a state-licensed private security firm, off-duty law enforcement officers when contracted through their agency, and specialized contract security for high-risk events (High Holy Days, Christmas Eve, Eid, large community gatherings). The category is subject to a percentage cap of the total award; applicants planning a significant contract security spend should check the current NOFO cap before assembling the budget.
What contract security does not cover: in-house security staff salaries, volunteer security team compensation, stipends for clergy or ushers or congregation members serving in a security role, background checks for the organization’s own employees or volunteers, and insurance premiums for in-house staff. The NOFO enforces a distinction between contracted services from a licensed third-party vendor (allowable) and payroll for the organization’s own staff or volunteers (not allowable). A house of worship that wants armed presence at services can fund a licensed off-duty officer or contract guard through NSGP, but cannot fund the salary of a member it hires onto its own payroll for the same role.
Documentation includes the vendor’s state license, the contract, time sheets, invoices, and proof of payment. Sites deploying armed contract security also need documentation that the local jurisdiction permits armed contract guards at the facility type.
Category 6: Management and Administration
Management and administration (M&A) covers the administrative work the awarded organization does to manage the grant itself: grant tracking and financial reporting, procurement file maintenance, reimbursement request preparation through the SAA portal, periodic performance reporting, coordination with SAA monitoring staff, audit preparation, and closeout documentation.
M&A is capped as a percentage of the total federal award. The current NOFO publishes the exact cap, and applicants who exceed it have the excess disallowed at award negotiation. M&A is paid as a direct cost when the activity is identifiable to the specific NSGP award and cannot be double-counted with indirect costs. Most awarded nonprofits do not max the M&A cap; using a portion for the grant accountant or grants manager’s documented time on the award is the typical pattern.
A Note on Indirect Costs
NSGP does not recognize indirect costs as a separate allowable line. There is no Category 7 for indirect cost recovery in the current FY25 NOFO. Organizations recover administrative overhead only through the Management and Administration category described above, which is capped at 5% of the total federal award.
This is a deliberate departure from the general Uniform Guidance treatment of indirect costs. The federal de minimis indirect cost rate, raised to 15% of modified total direct costs under the 2024 OMB revision to 2 CFR 200.414 (effective for awards on or after October 1, 2024), does not apply to NSGP awards. A negotiated indirect cost rate agreement (NICRA) held by the organization is likewise not chargeable to an NSGP award. Both apply to other federal programs; NSGP carves out its own M&A treatment.
Applicants who build a budget assuming a 10% or 15% indirect line on top of the direct cost categories will have that line removed at administrative review. The practical effect: every NSGP dollar funds either a direct security investment (planning, equipment, training, exercises, contract security) or the limited 5% M&A allocation for grant management work documented to the specific award.
Items That Look Allowable But Are Not
Applicants regularly assume items that sit just outside the six categories are allowable, and budgets that include them are flagged at administrative review.
Construction beyond hardening. Replacing a roof, expanding a footprint, adding a wing, renovating a sanctuary, or modernizing a kitchen is construction. NSGP funds hardening of existing structures (reinforced doors, ballistic film, bollards, fencing) but not general construction.
Employee salaries. Salaries of the organization’s own staff are not allowable under any category. This includes security directors, facilities managers, IT staff, clergy, executive directors, and administrative staff. The only exception is the narrow M&A direct charge for documented grant management time.
Food and beverages. Refreshments at training, meals at exercises, hospitality for volunteers, and any food cost is unallowable under the Uniform Guidance.
Fundraising costs. Time, materials, or services used to raise funds (including matching funds for the NSGP project) are not allowable. This includes development staff time, donor cultivation events, and grant writing for other funding sources.
Capital improvements unrelated to security. HVAC upgrades, plumbing, roof replacement, landscaping, signage refresh, and general property improvements are not allowable even if undertaken at the same time as the funded security project.
Pre-award costs. Expenses incurred before the official award date are not reimbursable. Organizations that begin procurement or training in anticipation of an award cannot recover those costs.
Equipment not on the AEL. Any item that does not appear on the AEL is unallowable regardless of how directly it addresses a documented vulnerability. The AEL updates between cycles; applicants reusing a prior budget should re-verify each line.
Replacement of functioning equipment. NSGP funds new mitigation of documented gaps. Replacing a working camera system with a newer model because the existing one is several years old is a refresh, not a documented gap, and refreshes do not qualify.
State-Program Allowability Differences
Most applicants who stack federal NSGP with a state nonprofit security grant assume the allowable cost lists are identical. They are not.
New Jersey NSGP requires photographs. New Jersey requires photographs of each access point referenced in the vulnerability assessment as part of the submission. Federal NSGP does not. Applicants who submit the federal IJ and assessment to NJ without adding photographs are flagged at NJ administrative review.
Tennessee HOW funds personnel only. The Tennessee Houses of Worship Security Grant covers contract security and (in recent cycles) training, not equipment. Tennessee houses of worship that want to fund hardening apply to federal NSGP for the equipment and use the state HOW award for personnel.
Connecticut NSGP does not fund personnel. The Connecticut state NSGP-equivalent program funds physical security investments but excludes contract security personnel, which the federal NOFO allows. CT applicants who plan to use state funding for contract guards have to redirect those costs to federal NSGP or to another funding source.
Other states (Pennsylvania NSGFP, Maryland PAHC, New York SCAHC, California CSNSGP, Illinois NSGP-IL, Ohio OSG, Massachusetts CNSGP, Arizona NSGP, Washington NROSGP, Georgia FPC, Colorado NSGP) publish state-specific NOFOs with allowable cost variations.
When stacking, the budget has to identify which line is funded by which program, show no line is double-funded, and confirm each line is allowable under the program funding it. A line allowable under federal NSGP and unallowable under the state program cannot move into the state budget mid-award without the SAA’s approval.
Frequently Asked Questions
Can NSGP funds pay for security guards on the organization’s own payroll?
No. NSGP funds contract security from a licensed third-party vendor. Salaries for the organization’s own employees, including in-house security staff, are not allowable. Organizations that want armed presence at services can fund licensed off-duty officers or contract guards through NSGP, but cannot fund the salary of a member they hire onto staff for the same role.
Can NSGP cover a brand-new building constructed for security purposes?
No. NSGP funds hardening of existing structures, not new construction. A nonprofit cannot use NSGP to build a new security vestibule from the ground up or expand a building footprint, even if the design is security-driven. Hardening modifications to existing structures (reinforced entries, ballistic glazing, bollards at existing approaches) are allowable.
Can NSGP funds buy a vehicle for security patrols?
Vehicles are generally not allowable. The AEL does not include passenger vehicles for security patrols. Specialized equipment that mounts on or supports vehicles may be allowable in narrow circumstances; the vehicle itself is not.
Does NSGP cover background checks for staff and volunteers?
Background checks for the organization’s own employees and volunteers are not allowable. Background checks performed as part of a contract security vendor’s vetting of their own personnel are bundled into the vendor’s contract cost.
Can a portion of NSGP funds be used for general operating expenses?
No. NSGP is a restricted federal award. Funds cannot be redirected to general operating expenses, programming unrelated to security, fundraising, rent, utilities, or any other cost outside the six allowable categories. NSGP does not allow indirect cost recovery through the de minimis rate or a NICRA; administrative overhead is reimbursed only through the 5% Management and Administration cap.
Can NSGP funds be used to buy firearms or ammunition?
Firearms are not allowable. Houses of worship that maintain volunteer armed teams cannot fund firearms, ammunition, or related equipment for those volunteers through NSGP. Armament held by licensed contract security personnel is handled through the vendor’s contract.
What We Do
Security Grant Advisors builds NSGP budgets that map cleanly to the six allowable cost categories before submission. The work covers budget line construction against the current NOFO, AEL verification for every equipment line, planning and M&A cap calculations, vendor quote assembly, and category-by-category review against the published rubric.
If your nonprofit is scoping a budget for an upcoming NSGP application and wants every line item validated against the six allowable cost categories, plus a sanity check against state-program allowability when stacking (the federal NOFO and state NOFOs differ on what each will fund), SGA reviews application budgets and rewrites lines that would fail administrative review. You can book a free consultation with SGA here.
Official Sources
Every claim in this guide traces back to a primary federal source. Confirm the current cycle’s allowable cost categories, percentage caps, and AEL contents at the official URLs below before assembling a budget.
- FEMA Nonprofit Security Grant Program (NSGP): https://www.fema.gov/grants/preparedness/nonprofit-security
- Grants.gov opportunity portal: https://www.grants.gov/
- 2 CFR Part 200 (Uniform Guidance for federal awards, including indirect cost rules): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
- U.S. Department of Homeland Security: https://www.dhs.gov/
State Administrative Agencies publish state-specific NOFOs with state-program allowable cost variations. Confirm the current SAA contact for your state through the FEMA grants portal above before stacking federal NSGP with a state program.