What you're actually paying for
A security vulnerability assessment is not a form someone emails you. It's a trained practitioner walking your property, studying how people move through it, and measuring what they find against recognized federal standards, then writing it up in a document you can act on and, where it applies, attach to a grant application.
So the price reflects real work: the on-site walkthrough, the analysis of threats specific to your organization and location, the physical and procedural review of every entry point and gathering space, and the written report with prioritized, costed recommendations. A credible assessment is a professional deliverable, not a checklist.
What drives the price
Three things move the number more than anything else.
- Size and complexity of the facility. A single-building congregation is a different job than a multi-wing campus with a school, a gym, and a daycare. More square footage, more entrances, and more distinct spaces mean more to assess.
- Number of sites. One location is one assessment. A diocese, a school network, or a nonprofit with several buildings needs each site evaluated, though assessing them together is usually more efficient than one at a time.
- Scope. A focused physical-security review is one level. A broader engagement that also covers personnel security, emergency operations planning, staff training, or a written security plan is more involved, and priced accordingly.
Travel plays a smaller role, but a local firm that can reach your property without overnight travel generally costs less than a national firm flying someone in.
The ballpark
Every facility is different, so treat this as orientation, not a quote. For a single-site house of worship or nonprofit, a professional vulnerability assessment typically falls in the low thousands, with larger or multi-site engagements running higher as scope grows. That's a real investment, and far less than the cost of a single serious incident, a failed grant application, or an insurance dispute over whether you exercised due diligence.
The part most people miss: the grant can pay for it
Here's what changes the math for many nonprofits and houses of worship. A vulnerability assessment is an allowable expense under the federal Nonprofit Security Grant Program and similar programs, and the assessment is the document NSGP requires you to submit. So it isn't an add-on cost. It's the foundation of the application that funds everything else.
One caution specific to Virginia: assessments completed before an award are treated as pre-award costs and are not reimbursed, so plan the timing with your application in mind. Either way, the assessment pays off. Funded or not, you get a prioritized list of what to fix first. Check your eligibility in a few minutes.
Why the cheapest option can cost more
Free or bargain assessments exist: a generic online checklist, a well-meaning volunteer, a vendor who "assesses" your site and happens to sell exactly what they recommend. The problem is that grant reviewers and insurers can tell the difference, and a thin assessment is the most common reason a strong-sounding application scores poorly. Paying for a defensible, standards-based assessment up front is usually what unlocks the much larger grant dollars behind it.
Can't we just use a free checklist? CISA's self-assessment tools are a good start. A professional assessment adds an outside eye and documentation reviewers take seriously.
How to get a real number
An honest price comes from a short conversation, not a web page, because it depends on your building, your sites, and what you need the assessment to do. That call is free, and it's the same one where we tell you whether an assessment even makes sense for you and whether grant funding is realistic this cycle.
If you want an outside reader for the application itself, our NSGP application help includes Investment Justification review before you submit.
