The Department of Homeland Security's main state and local grant portfolio, the Homeland Security Grant Program, distributes roughly $1 billion a year through FEMA — primarily via the State Homeland Security Program and the Urban Area Security Initiative, which targets about 30 of the country's highest-risk urban areas — alongside a nonprofit security grant that Congress set at $360 million for fiscal 2024. Every dollar carries eligibility rules, risk scoring, and spending mandates written into appropriations law.
This explainer follows the money from appropriation to reimbursement: which programs exist, how awards are calculated, what recipients must do to keep them, and where the documented friction sits. It draws on FEMA funding notices, appropriations acts, and Government Accountability Office reviews through fiscal 2024.
Which programs make up the portfolio?
Five carry most of the weight. The State Homeland Security Program funds planning, equipment, training, and exercises across all 50 states, territories, and tribal governments. The Urban Area Security Initiative concentrates money on the highest-threat cities — New York, Los Angeles, Chicago and roughly two dozen others — selected by risk analysis. The Nonprofit Security Grant Program hardens at-risk nonprofits — synagogues, mosques, churches, schools — with security equipment and facility upgrades, capped at $150,000 per organization in recent cycles. Operation Stonegarden reimburses border-area law enforcement for cooperative security operations. And the Transit and Port Security Grant Programs protect the surface transportation and maritime systems. Appropriations since 2018 also require that at least 30 percent of SHSP and UASI money go to law enforcement terrorism prevention activities — a congressional mandate that changed how cities plan their portfolios.
How are awards actually decided?
Two mechanisms combine. Formula money is driven by legislation: minimum allocations for every state, with the remainder split by risk factors — population, infrastructure, threat intelligence — codified in the 9/11 Act and appropriations language. Competitive allocations, chiefly UASI urban area selections, come out of FEMA's risk model, which scores threat, vulnerability, and consequence and has drawn sustained GAO scrutiny for methodology transparency. Before spending anything, every recipient must complete a Threat and Hazard Identification and Risk Assessment and an investment justification tied to the National Preparedness Goal. Money is then spent and reimbursed — jurisdictions pay first, submit documentation, and draw down later, which is why grant managers, not equipment catalogs, dominate local experience of the program.
| Program | Recipients | Approximate scale (FY2024) |
|---|---|---|
| State Homeland Security Program | All states, territories, tribes | About $490 million |
| Urban Area Security Initiative | Roughly 30 urban areas | About $620 million |
| Nonprofit Security Grant Program | At-risk nonprofits | $360 million |
| Operation Stonegarden | Border-area law enforcement | About $85-90 million |
| Transit Security Grant Program | Major transit agencies | About $250 million |
What do recipients have to do to keep the money?
The conditions are the program's real politics. Grants fund allowable activities — planning, organization, equipment, training, exercises — and FEMA maintains an authorized equipment list that excludes, for instance, most personnel costs and weapons purchases outside narrow categories. Recipients face audits, single-audit requirements above spending thresholds, and clawback for unallowable costs. Maintenance-of-effort and matching rules apply in some programs, and the 30 percent law-enforcement mandate constrains planning at the state level. GAO reviews have repeatedly documented the consequence: slow drawdowns, with hundreds of millions of dollars in older grants unspent past their periods of performance, and small jurisdictions struggling with the administrative burden the reimbursement model imposes.
Related stories: Why US Water Systems Face Cyber Risk · Guam Defense: The Plans and the Price.
What are the standing criticisms — and answers?
Two arguments recur on the record. Critics, including some congressional appropriators and think-tank analysts, argue the money is spread by politics as much as risk: every state gets a minimum allocation regardless of threat, diluting the highest-risk cities. Defenders answer that national resilience requires baseline capacity everywhere, and that the 9/11 Congress wrote the minimums deliberately. The second criticism is overhead: GAO and inspector-general reports document grants spent late or lapsed entirely because small recipients could not manage compliance. FEMA's responses — simplified applications, consolidated notices, longer performance periods — are documented, and their effect is tracked in the agency's own annual reports.
How has the money performed in practice?
The portfolio's outcomes are measurable, and they are mixed on the record. Grant periods of performance have regularly ended with large unspent balances: DHS Office of Inspector General and GAO reviews have repeatedly cited hundreds of millions of dollars in preparedness grants expired or lapsing without expenditure, concentrated among smaller recipients. The causes documented are administrative rather than intentional — procurement rules that stretch equipment purchases across years, documentation requirements the reimbursement model imposes, and grant-manager turnover in jurisdictions that received awards precisely because they lacked staff. FEMA's documented responses include consolidating what were once separate funding notices, simplifying investment justifications, and extending performance periods. The oversight record cuts both ways: the same reports that document slow spending also document the money buying real capability — interoperable communications, regional response teams, and hardened facilities that were tested in subsequent disasters and attacks. The performance question, as GAO frames it, is no longer whether the grants buy capability, but whether the smallest recipients can convert funding into capability at the pace Congress appropriates it.
Why did the nonprofit program grow so fast?
The Nonprofit Security Grant Program is the portfolio's fastest growth story, and its trajectory explains the politics of the whole system. Created in fiscal 2014 with roughly $13 million, it stayed small for years while documented attacks on synagogues, mosques, and churches accumulated — Pittsburgh in 2018, Poway in 2019 — and advocacy from Jewish, Muslim, Sikh, and Christian organizations pushed Congress to scale it. Appropriations roughly doubled the program in the early 2020s and set it at $360 million for fiscal 2024, its largest level, with awards capped at $150,000 per organization for target-hardening: cameras, doors, access control, guard training. FEMA administers it through the same state channels as the rest of the portfolio, which has produced the documented friction — nonprofits apply through state administers, application windows are short, and demand has exceeded funding in every major urban area. The program matters beyond its size because it marks a policy shift: preparedness money once aimed at first responders now reaches private buildings, making DHS grants part of the security budget of houses of worship — a change Congress made deliberately and has protected through successive appropriations cycles.
What does this change?
The grant portfolio is where federal homeland security priorities become municipal budgets, and its annual cycle signals them first: the risk scores that pick urban areas, the mandate percentages that shape police-adjacent spending, and the nonprofit program that grew fastest in the 2020s. The markers to watch are the fiscal 2026 allocations — whether the urban-area list and program totals move — and whether Congress acts on the GAO's persistent findings about slow drawdown. For cities, the practical constant is that DHS security money arrives as a conditional contract, not a check.