Much of this work can be paid for by federal and state programs, donated technology and university clinics. Start with the national programs that apply everywhere, then check your state.
Six places to look before you ask your board for budget.
The main federal program. FY 2026 made $300 million available for nonprofits at risk of terrorist or extremist attack, covering physical security, cybersecurity, planning, training and exercises. Nonprofits apply through their State Administrative Agency, listed below. The FY 2026 window closed July 24, 2026, so plan for the next cycle now.
Federal cybersecurity funding that flows to states and then to local governments. Nonprofits are not direct applicants, but if you share services with a city, county, school district or tribe, ask whether a joint project is possible.
The Cybersecurity and Infrastructure Security Agency offers free vulnerability scanning, assessments and guidance for organizations, including nonprofits. Not a grant, but it reduces what you need to fund.
A growing network of university clinics provides free security help to nonprofits and small organizations, with students working under faculty supervision. Check the Consortium of Cybersecurity Clinics for one near you.
TechSoup, Microsoft for Nonprofits, Google for Nonprofits, Cloudflare Project Galileo and OpenAI for Nonprofits offer free or reduced cost tools. Terms change, so confirm current offers before you budget.
Community foundations, state nonprofit associations and many program funders will fund security and AI readiness as capacity building. Ask your existing funders first; the project is often eligible under a grant you already have.
Every federal NSGP application goes through your State Administrative Agency. Get on its mailing list so you hear when the window opens.
A growing number of states fund their own nonprofit security grants, often for organizations the federal program did not reach.
Free and discounted technology shrinks the budget you need to raise, and funders like to see it.
A grant application needs a risk narrative, a scoped project and quotes. Bit Fellowship can prepare all three.
For every state and territory: the agency that takes federal NSGP applications, any state funded nonprofit security program we know of, and the state association of nonprofits that tracks local grants and capacity building funds.
Agency names and phone numbers are from FEMA’s State Administrative Agency contact list and state associations are from the National Council of Nonprofits network directory, both checked October 20, 2026. Links go to each agency’s main site, since grant pages move every cycle; look for Grants or NSGP once there. State program names are a starting point: application windows, eligibility and whether cybersecurity costs are allowed change yearly, so confirm with the agency before planning around a program. Community foundations and your existing funders are also worth asking, since security and AI readiness often qualify as capacity building.
Bit Fellowship can scope the project, write the security narrative and gather the quotes a grant application needs, then deliver the work once it is funded.