Virginia's FY2026 Nonprofit Security Grant Program window opened July 1 and closed July 10 at 5 p.m. Ten days.
In 2024, the window ran about five weeks, April 19 to May 24. It's getting shorter, not longer.
The organizations funded in July didn't start in July. They started the fall before. Do these five things now and you'll be ready to submit, not scramble.
Preparation is what worked
On March 12, 2026, an attacker drove a pickup truck through the front entrance of Temple Israel in West Bloomfield, Michigan, and down the hallway. Armed security stopped him. Teachers followed their training, and all 140 children in the on-site early childhood center got out unhurt. One security guard was injured; no children or congregants were seriously hurt.
In June 2025, a gunman opened fire outside CrossPointe Community Church in Wayne, Michigan, during Sunday worship with about 150 people inside. A deacon and church security stopped him before he got in. One security guard was wounded.
Neither outcome was luck. Both came from preparation done long before the day.
In nearly two decades of federal law enforcement, I saw the same pattern again and again. The warning signs were there. No one had written them down.
Why the window catches people off guard
FEMA released the FY2026 funding notice in July 2026 with a federal deadline of July 24. Virginia's deadline was July 10, two weeks earlier. The state deadline is the one that matters. Leaders who watch only the federal date miss it.
The release date moves. In 2024 the notice came out in April; in 2026, July. You can't plan around a date, only around being ready.
The application is a package, not a form: a mission statement, a vulnerability assessment, and an investment justification, each in a specific format.
Volunteer boards move slowly. One missed meeting can eat half a 10-day window. I've watched a board learn the window was open, schedule a vote for next month's meeting, and miss the deadline. It happens often. The usual answer is "we'll apply next year." Next year's window may be shorter, and the vulnerability isn't going anywhere.
1. Get your paperwork in order
- Confirm eligibility. You must be a tax-exempt 501(c)(3) or an organization described under 501(c)(3). Eligible: houses of worship, schools, shelters, senior centers, camps, museums, and community service organizations. Ineligible: public schools, government entities, HOAs, labor unions, and politically active or lobbying organizations. Check your eligibility in five minutes.
- Register in SAM.gov now. Virginia doesn't require a UEI to apply, but you need a valid UEI and full SAM.gov registration to receive an award and get reimbursed. Registration is free. Name or address mismatches can stall it for weeks.
- Match your records. Your legal name, address, and EIN must match across the IRS, SAM.gov, and your application.
- Update your mission statement. VDEM uses it to confirm what kind of organization you are.
- Assign one owner. A committee never meets a 10-day deadline. Name one point of contact to manage every deadline.
Isn't SAM.gov for government contractors? Any organization receiving federal funds needs it. Skip the paid registration services. Registering at SAM.gov is free.
2. Document your threat history
Projects must tie threats to existing physical vulnerabilities, and the threats must relate to terrorism or extremism. Reviewers fund documented risk.
What counts: threats received, hate-motivated incidents, vandalism, suspicious surveillance of the building, hostile online posts, trespassing, and attacks on similar organizations. Report incidents to police and keep the case number. Report numbers carry weight.
Start an incident log today. Record the date, time, what happened, who saw it, photos, and whether police were called.
Investigator's tip: write it the same day, specific and factual. Dated, factual notes hold up. Vague memories don't. I've seen cases made or broken on simple log entries matched to dates and locations.
National context counts. Attacks on Jewish, Christian, Latter-day Saint, Muslim, and other faith communities in 2025 and 2026 are part of the threat picture reviewers see. Don't exaggerate. Accurate beats dramatic, and reviewers can tell the difference. The Grand Blanc attacker reportedly hated the faith he targeted for years. Grievances build over time, which is why documenting odd behavior matters.
We don't want to call police over small things. I get it. A report isn't an accusation. It's a record, and records are what reviewers read.
3. Get the vulnerability assessment done early
The assessment is the foundation. Every item you request must trace back to a vulnerability it identifies. Each facility needs its own assessment and its own investment justification.
A good assessment covers the perimeter, vehicle approaches, entry points, access control, lighting, cameras, communications, and emergency plans. It also accounts for how people actually use the building: services, school days, childcare, weekend events.
Vehicles belong in the threat picture. The Temple Israel attack and the September 2025 attack on a Latter-day Saint church in Grand Blanc, Michigan, both began with a truck driven into the building. A good assessment looks at standoff distance and barriers.
Assessors book up once the window opens. The off-season gives you time to read the findings, ask questions, and get quotes.
Know the cost up front. Assessments done before an award are pre-award costs and aren't reimbursed in Virginia. Treat it as an investment that pays off either way. Funded or not, you get a prioritized list of what to fix first.
Can't we just use a free checklist? CISA's self-assessment tools are a good start. A professional assessment adds an outside eye and documentation reviewers take seriously.
Will this make our building feel like a fortress? No. Good security is mostly invisible: lighting, procedures, trained greeters, controlled entry.
4. Start the investment justification now
The investment justification (IJ) is the heart of the application. It answers three questions: What's the threat? Where are you vulnerable? What will you do to reduce the risk?
Every request needs a clear line from threat to vulnerability to fix. A shopping list of cameras and fencing with no "why" won't score.
- Use the current year's fillable form, unaltered. VDEM disqualifies applications on outdated versions.
- Draft in Word now. Paste your narrative into the new form when it's released.
- Know what's allowable. Facility hardening, security equipment, planning, training, exercises, and contracted security. Contracted security can't be sole sourced, and grant funds can't directly hire law enforcement.
- Know the caps. In FY2026, Virginia allowed up to $200,000 per application and up to three sites, for a maximum of $600,000. In 2024 the cap was $150,000.
- Get real vendor quotes. Your budget shouldn't be guesswork.
- Have an outsider read it. If they can't follow your logic, a reviewer won't either.
What about cash flow? NSGP is reimbursement based. You pay first and get reimbursed as approved phases are completed. Your board needs to plan for that up front.
5. Know your state contact
Nonprofits don't apply to FEMA directly. In Virginia, you apply through the Virginia Department of Emergency Management (VDEM), which reviews applications with regional working groups and sends a combined application to FEMA.
- Know your track. Hampton Roads is a designated urban area with its own application track and file naming rules. Northern Virginia applies through the National Capital Region.
- Submit through the VDEM Grants Portal.
- Sign up for VDEM grant notices so you hear the day the window opens.
- Follow the rules exactly. No password-protected files. Use the naming conventions as written. Small mistakes get applications tossed.
- VDEM grants contact: [email protected]
Outside Virginia? Find your State Administrative Agency. The steps are the same.
Funding is competitive. Virginia had about $3.4 million in FY2026, up from $2.7 million in 2024. That's real money, but not every applicant gets funded. Preparation is what separates them.
Ten days
That's how long Virginia organizations had this year. The ones that made it didn't work faster. They started sooner. Nobody knows the next window's date, so the only safe plan is to be ready before it opens.
The five steps:
- Get your paperwork in order: nonprofit status, SAM.gov and UEI, mission statement.
- Document your threat history, and keep doing it.
- Get your vulnerability assessment done while assessors have time.
- Draft your investment justification now and paste it into the new form when it's released.
- Know VDEM. Sign up for notices and follow the rules exactly.
This isn't really about a grant. It's about knowing your building, your risk, and your plan. Temple Israel's staff trained long before the day they needed it, and 140 children got out safely. Every step here makes your people safer, funded or not. A funded application is a bonus. A prepared congregation is the goal.
If this feels like a lot, that's exactly why you start now and not in July. You don't need to do it all this week. Take one step this month: assign an owner, open your SAM.gov registration, or start the incident log. The organizations that win aren't the biggest. They're the ones that prepare.
I spent nearly two decades in federal law enforcement. The hardest conversations I had were with people who saw warning signs and meant to do something later. I started SafetySync so congregations and nonprofits don't become one of those stories.
Preparation isn't paperwork. It's protection.
Sources: New York Times via GV Wire, FOX 2 Detroit, Michigan Public.