Nonprofit Security Grant Program

The Nonprofit Security Grant Program (NSGP) is a federal grant program administered by the U.S. Department of Homeland Security through the Federal Emergency Management Agency (FEMA), with State Administrative Agencies (SAAs) responsible for administering funds and coordinating with eligible nonprofit organizations. In Kentucky, the Kentucky Office of Homeland Security (KOHS) is accepting nonprofit applications for the program. NSGP is intended to enhance the physical and cybersecurity and facility or target hardening of nonprofit facilities that are at high risk of terrorist or other extremist attack. The program also seeks to integrate nonprofit preparedness activities with broader state and local preparedness efforts. For FY 2026, $300 million is available nationally, divided equally between the NSGP Urban Area and NSGP State funding streams. Eligible nonprofit organizations generally must be described under section 501(c)(3) of the Internal Revenue Code and exempt from tax under section 501(a), although qualifying churches, mosques, synagogues, and similar organizations that are automatically exempt are not required to obtain IRS recognition of exemption. A nonprofit must demonstrate through its application that it is at high risk of a terrorist or other extremist attack. NSGP-UA supports eligible nonprofits located within designated high-risk urban areas, while NSGP-S supports eligible nonprofits outside those designated areas. Examples of eligible organizations include houses of worship, museums, educational facilities, senior centers, community centers, and day camps. Private colleges and universities may also qualify when they are eligible 501(c)(3) entities. Kentucky nonprofits apply through KOHS as the SAA rather than directly to FEMA. Allowable costs generally fall within planning, equipment, training, and exercises and must address identified security risks and vulnerabilities. Examples include physical security enhancements, closed-circuit television security cameras, security screening equipment, access controls, fencing, gates, barriers, security planning, active shooter and employee security training, response exercises, and eligible cybersecurity improvements. Projects must be feasible, effective in reducing identified risks, and capable of completion during the three-year period of performance. Certain costs are prohibited, including general-use expenditures, most organization and operational overtime costs, development of vulnerability assessment models, costs to fund vulnerability assessments or development of the Investment Justification itself, proof-of-concept initiatives, technology-development studies, and projects benefiting ineligible entities. There is no cost-share requirement. Kentucky describes the nonprofit award as reimbursement-based, meaning selected nonprofits pay approved equipment and service expenses first and then request reimbursement. A nonprofit with one site may request up to $200,000 for that site. Organizations with multiple locations may submit applications for up to three sites per funding stream, at up to $200,000 per site, subject to a maximum of $600,000 per state. Each application may represent only one site, location, or physical address, and each site requires its own complete Investment Justification and unique site-specific vulnerability or risk assessment. Each eligible nonprofit subapplicant must provide an NSGP Investment Justification, a site-specific Vulnerability/Risk Assessment, and a Mission Statement, including relevant mission implementation policies or practices that may elevate risk. The Kentucky application materials also include an Applicant Information and Budget Table, an applicant walkthrough, a DHS CISA Faith Based Self-Assessment, and an application submission checklist. Applications undergo state and federal review. Threshold issues that can disqualify a subapplication include an incomplete package, administrative noncompliance, use of incorrect or prior-year forms, poor grant administration history, application to the wrong funding stream, or organizational ineligibility. Review considers the substantiation of current or persistent threats, symbolic value of the site, the organization's role in responding to or recovering from attacks, alignment of proposed activities with vulnerabilities identified in the vulnerability assessment, integration with state and local preparedness, feasibility and effectiveness, and prior NSGP funding history. The SAA scores and ranks applications before federal review. Final scoring applies an organization-type multiplier, and applicants that have never received an NSGP award receive an additional 15 points. Federal review also checks eligibility, project allowability, and applicable security information. For Kentucky nonprofit subapplicants, the stated submission deadline is Monday, July 13, 2026, at 11:59 PM Eastern Time. This is earlier than FEMA's July 24, 2026 federal deadline because nonprofits submit through their SAA and do not apply directly to FEMA. The federal NOFO projects an application start date of June 24, 2026, with funding selections and awards anticipated no later than September 30, 2026. The projected federal period of performance and budget period run from September 1, 2026 through August 31, 2029. The program materials do not identify a separate Kentucky LOI, concept paper, or other pre-application gating deadline. FEMA program questions may be directed to FEMA-NSGP@fema.dhs.gov. NSGP has operated across multiple fiscal years, and the FY 2026 NOFO expressly discusses FY 2025 priorities and prior-year NSGP funding, supporting treatment of the opportunity as an annually recurring program for tracking purposes. Because the Kentucky July 13, 2026 nonprofit deadline has passed as of August 7, 2026, the current cycle is no longer accepting applications. For recurring-opportunity tracking, the next cycle is projected for June 2027 by mirroring the June 2026 application opening month; this is a tracking projection rather than an announced FY 2027 application date.

Use the correct current-year forms and submit a complete package; substantiate current or persistent threats and explain the site's vulnerability and consequences; directly align requested projects with vulnerabilities identified in the site-specific assessment; demonstrate that each project is feasible, effective, and completable within the three-year performance period; use a unique vulnerability assessment for every physical address; clearly explain integration with broader state and local preparedness efforts; first-time NSGP applicants receive 15 additional points in final scoring.