Security assessments for houses of worship and nonprofits
Churches, synagogues, mosques, temples, faith-based schools and charities at risk of attack can apply for federal and state funding to make their buildings safer. FEMA’s Nonprofit Security Grant Program, applied for through your state, requires a vulnerability assessment for every site, and every item you ask for has to answer a vulnerability it found. We carry out that assessment, physical and cyber, so your application, and the work it pays for, rests on real findings.
Who it is for
- Houses of worship of every faith, and faith-based schools and community centers.
- Charities, cultural centers and other 501(c)(3) organizations at risk of terrorist or other extremist attack because of their mission, beliefs or the people they serve.
- Organizations applying for the first time, or reapplying after an unsuccessful application.
- Grant recipients who need the funded work specified properly and checked once it is installed.
How the funding works
FEMA Nonprofit Security Grant Program (NSGP)
Federal funding for physical and cybersecurity improvements at nonprofits at high risk of terrorist or other extremist attack. Nonprofits do not apply to FEMA directly: you apply to your State Administrative Agency, usually the state’s homeland security or emergency management office, which applies to FEMA.
- Two funding streams: NSGP-UA for nonprofits in designated high-risk urban areas, and NSGP-S for those outside them.
- In FY 2025, FEMA allowed up to $200,000 per site, for up to three sites per funding stream. Amounts and rules change each year, and your state’s current guidance is the authority.
- Allowable costs include equipment from FEMA’s Authorized Equipment List, planning, training, exercises and contract security.
- Applicants must be organizations described in section 501(c)(3). FEMA notes that churches, mosques and synagogues are automatically exempt if they meet its requirements and do not need an IRS determination letter.
The vulnerability assessment
One per site: FEMA says an application for several sites without an assessment unique to each may be rejected. FEMA accepts a CISA self-assessment, a state or local law enforcement assessment, a contractor’s assessment or another valid method. Whichever you use, your Investment Justification has to explain how each item you request addresses a vulnerability the assessment found.
Cybersecurity is part of it
FEMA’s FY 2025 NSGP guidance lists enhancing cybersecurity as a priority area: risk-based cybersecurity planning, the cybersecurity of access control and identity verification systems, the cybersecurity of security technology such as cameras, and adoption of CISA’s Cross-Sector Cybersecurity Performance Goals. Cameras and door controllers bought with the grant are network devices. A camera system anyone on the internet can reach is a vulnerability, not a fix.
State programs
Several states also fund their own nonprofit and house-of-worship security grants, run by the state’s emergency management, homeland security or criminal justice agency, each with its own eligibility, deadlines and assessment requirements. We write the assessment to the format your state asks for.
How we assess
- The approach and perimeter: sightlines, lighting, parking, vehicle approach and the places someone could wait unseen.
- Entrances during services and events, when doors are open and volunteers are greeting, as well as when the building is empty.
- Doors, locks, glazing and the rooms where people would shelter.
- Cameras, alarms and access control: coverage, who watches them, and how they are reached remotely.
- Cybersecurity: camera and access control systems, Wi-Fi and network, member and donor data, email and accounts, against CISA’s Cross-Sector Cybersecurity Performance Goals.
- People and plans: greeters and safety teams, lockdown and evacuation procedures, and coordination with local police.
- Online exposure: what is published about your services, staff and building that would make planning an attack easier.
What you receive
- A written vulnerability assessment for each site, in the format your State Administrative Agency asks for.
- A ranked list of fixes, each with a price range and the vulnerability it addresses, ready to carry into your Investment Justification.
- A cybersecurity assessment of the systems you run or plan to buy, with the settings to change.
- After an award: help writing the equipment specification, and a check that what was installed matches what was funded.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one or two visits per site, at least one during a service or event, and a written report within two weeks. Tell us your state’s application deadline at scoping and we plan around it.
Common questions
Do you write the grant application?
We write the vulnerability assessment and give you the findings, price ranges and the reasoning behind each item, which is the substance of the Investment Justification. Your organization submits the application to your State Administrative Agency. We cannot promise an award: funding decisions are made by your state and FEMA.
Is there a free option?
Yes, and you should know about it. CISA publishes a free security self-assessment for houses of worship, and CISA Protective Security Advisors and some local police departments carry out site assessments at no charge. FEMA accepts these. An independent assessment is worth paying for when you want cybersecurity covered properly, need it before a deadline, or want findings detailed enough to specify equipment from.
Can grant money pay for this assessment?
Not the assessment that supports your application. It is done before the award, and FEMA’s FY 2025 guidance says subrecipients cannot claim pre-award costs. Planning work after an award may be allowable; your State Administrative Agency decides.
Do you need to attend a service?
Ideally once. A building is a different place with hundreds of people arriving at once and the doors open. We attend as any visitor would, agreed with your leadership in advance, and do nothing that disrupts worship.
Do you sell or install equipment?
No. We take no referral fee or commission on anything we recommend, so the list in your application is what the building needs, not what a vendor sells.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Houses of worship & nonprofits
We reply within one business day.
Nothing you send is shared outside Calibre.