Rural multi-buyer minimum-viable-stacking municipal IT-MSP — 10 small principals on a 23K-population Cumberland-Gap base where CJIS, KORA, and cyber-insurance compliance exceeds in-house capacity.

Ten principals on a 23,000-population county is unusual. The Bell County Fiscal Court (Judge-Executive Albey Brock; courthouse plus Justice Center, County Clerk, Sheriff, Jailer, and PVA) holds $6.83 million across 64 HUD awards on the federal contracting data. The City of Pineville (Mayor Scott Madon, 110 W Kentucky Ave) runs an annual city budget of roughly $2 to $5 million with 10 to 20 workstations; Pineville PD operates under CJIS. The City of Middlesboro (Mayor Boone Bowling, 1729 Cumberland Avenue) runs an annual budget of roughly $8 to $15 million with 25 to 50 workstations; Middlesboro PD is the largest CJIS principal. The city adopted a Kentucky League of Cities Strategic Plan in July 2025. Bell County Schools (Superintendent Brian Crawford) runs about 2,441 students across 7 schools on Infinite Campus SIS with 1:1 devices and holds $4.75 million across 2 awards largely tied to Central States Bus Sales EPA Clean School Bus pass-through. Middlesboro Independent (Superintendent Bill Jones) runs full K-12 inside Middlesboro city limits. Pineville Independent (Superintendent Russell Thompson) runs full K-12 inside Pineville city limits and holds $4.99 million across 12 Department of Justice awards — the highest federal-procurement intensity per student among Bell K-12. The Housing Authority of Middlesboro holds $16.23 million across 25 HUD awards. The Pineville Municipal Housing Authority holds $6.03 million across 13 HUD awards. Bell-Whitley CAA holds $26.83 million across 3 HHS awards (the single largest Bell-PoP federal recipient) at 129 N Pine St. The Middlesboro-Bell County Airport (KMBO) holds $1.35 million across 4 FAA AIP awards.

Compliance stack that exceeds in-house capacity at each principal. The FBI CJIS Security Policy (currently v5.9, transitioning to v6.0) mandates 13 policy areas including incident response, identification and authentication, configuration management, formal access audits, and personnel screening; this applies to Middlesboro PD, Pineville PD, and the Bell County Sheriff. The Kentucky Open Records Act (KRS 61.870 to 61.884) covers records retention, KORA fulfillment, email archive, and redaction at every principal. Cyber-insurance carrier requirements tightened from 2023 to 2025 — multi-factor authentication everywhere, endpoint detection and response coverage, immutable backups, security-operations-center monitoring, incident-response retainer, and security-awareness training. Every principal carries a cyber-policy renewal with an annual attestation an in-house bookkeeper cannot complete. HUD REAC and PIC compliance applies to the two housing authorities. The Kentucky Department of Education district-cybersecurity-plan mandate applies to the three K-12 districts. FAA reporting applies to the airport.

Per-principal IT spend on the 2026 baseline that a vendor can pursue. Fiscal Court $60,000 to $150,000 per year (the largest principal, covering courthouse, sheriff, jailer, and PVA). City of Middlesboro $50,000 to $120,000 per year (CJIS-loaded). City of Pineville $20,000 to $50,000 per year. Bell County Schools $80,000 to $150,000 per year (the largest district, with 7 schools and 1:1 devices). Middlesboro Independent $35,000 to $70,000 per year. Pineville Independent $25,000 to $55,000 per year. Housing Authority of Middlesboro $25,000 to $50,000 per year. Pineville Municipal Housing Authority $15,000 to $35,000 per year. Bell-Whitley CAA $30,000 to $80,000 per year (Head Start sites and CSBG software). Airport $5,000 to $15,000 per year. Aggregate addressable $345,000 to $775,000 per year; realistic $300,000 to $700,000 per year after incumbents holding partial accounts.

Escalating drivers. The annual cyber-insurance attestation cycle at each principal tightened over 2024 to 2025 (MFA, EDR, backup immutability); 2026 to 2027 renewals add security-operations-center monitoring, tabletop-exercise documentation, and supply-chain-vendor attestations. KORA records-management volume is rising and rural principals lack dedicated records officers. The FBI CJIS Security Policy v5.9-to-v6.0 transition adds new controls. The Kentucky Office of Homeland Security State and Local Cybersecurity Grant Program (SLCGP) pass-through funds project-overlay work. The Kentucky Department of Education district-cybersecurity-plan mandate drives Bell County Schools, Middlesboro Independent, and Pineville Independent toward plan updates, tabletop exercises, and incident-response retainer purchases.

The Bell model is stack-led rural — ten principals close enough in physical and social geography (Pineville and Middlesboro inside one 23,000-population county) that the social-network density itself is the moat, but each principal too small to stand alone. Stacking across all ten is the minimum-viable revenue floor. A vendor's reputation in one principal carries to the other five within months because the same administrators show up at the same Fiscal Court meetings, the same Bell Theater fundraisers, and the same Kentucky Mountain Laurel Festival dinners.

Founder model. A shared CIO-as-a-service in which the founder operates as fractional CIO across all ten principals — setting policy, sitting on cyber-insurance attestation calls, and signing CJIS Security Addenda as the named information security officer or security point of contact — plus M365 Government Community Cloud tenant administration, a firewall stack (Fortinet, SonicWall, or Meraki — all KIT-rideable), endpoint security (CrowdStrike, SentinelOne, or Huntress), KORA-compliance records management, cyber-insurance underwriting attestation, helpdesk Tier 1 and Tier 2, and on-call incident response.

Year-1 capital runs $90,000 to $180,000. Tools and equipment include laptops for the founder and a Tier-1 helpdesk seat, a firewall-stack lab unit, M365 Government Community Cloud tenant administration tools, an endpoint-security console (CrowdStrike, SentinelOne, or Huntress), KORA-compliance records-management tools, cyber-insurance attestation deliverables, and an incident-response retainer plus tabletop-exercise tooling. Add working capital plus a six-to-nine-month operating reserve to fund ramp.

Recurring retainer baseline, monthly per principal. Fiscal Court $2,000 to $2,500 ($24,000 to $30,000 per year). City of Middlesboro $1,800 to $2,500 ($22,000 to $30,000 per year, CJIS-loaded). City of Pineville $800 to $1,400 ($10,000 to $17,000 per year). Bell County Schools $2,000 to $2,500 ($24,000 to $30,000 per year). Middlesboro Independent $1,200 to $1,800 ($14,000 to $22,000 per year). Pineville Independent $900 to $1,500 ($11,000 to $18,000 per year). Housing Authority of Middlesboro $900 to $1,500 ($11,000 to $18,000 per year). Pineville Municipal Housing Authority $600 to $1,000 ($7,000 to $12,000 per year). Bell-Whitley CAA $1,200 to $2,000 ($14,000 to $24,000 per year). Airport $400 to $700 ($5,000 to $8,000 per year). Aggregate recurring at full ten-principal capture $142,000 to $209,000 per year.

Year 1 capture ramp. About 30 percent capture ($45,000 to $65,000 recurring) plus initial project overlay of $20,000 to $50,000 totals $65,000 to $115,000. Founder draw $45,000 to $80,000 against $90,000 to $180,000 of initial capital.

Year 3 capture. About 70 percent capture ($100,000 to $145,000 recurring) plus project overlay of $50,000 to $120,000 totals $150,000 to $265,000. Founder draw $90,000 to $160,000 with one Tier-1 helpdesk seat plus part-time admin.

Mature Year 4 and beyond. 85 to 95 percent capture ($120,000 to $200,000 recurring) plus project overlay of $80,000 to $200,000 totals $200,000 to $400,000. Founder draw $120,000 to $200,000 with full Tier 1 plus Tier 2 helpdesk plus admin.

Project overlay annualized average. A firewall refresh wave across the ten principals on a 5-to-7-year cycle places about 2 principals per year at $8,000 to $25,000 per principal, or $20,000 to $50,000 per year. M365 Government Community Cloud migration and re-tenant work runs $15,000 to $40,000 per year. KORA records-management rollouts $15,000 to $50,000 per year. Cyber-insurance attestation and remediation work $20,000 to $60,000 per year. SLCGP-funded cyber-improvement projects $20,000 to $80,000 per year while the program is sustained. Incident-response retainer, tabletop exercises, and security-awareness training $15,000 to $40,000 per year. Aggregate project overlay $105,000 to $320,000 per year realistically, or $80,000 to $200,000 per year after capture share and competitive-bid losses.

• Bell County Judge-Executive Albey Brock (Bell County Fiscal Court; courthouse, Justice Center, County Clerk, Sheriff, Jailer, and PVA)

  County government — the largest local-government federal-procurement surface in Bell

  Active in market

  $6.83 million across 64 HUD awards on the federal contracting data. The 2026 GOP primary is procedural context for vendor-continuity considerations.
• City of Pineville Mayor Scott Madon (110 W Kentucky Ave) and City of Middlesboro Mayor Boone Bowling (1729 Cumberland Avenue)

  Home-rule cities (dual-municipality CJIS principals)

  Active in market

  Pineville PD and Middlesboro PD CJIS. Middlesboro adopted a Kentucky League of Cities Strategic Plan in July 2025 with small-business development as the top priority.
• Bell County Schools Superintendent Brian Crawford, Middlesboro Independent Superintendent Bill Jones, and Pineville Independent Superintendent Russell Thompson

  Three K-12 districts under the KDE district-cybersecurity-plan mandate

  Active in market

  Bell County Schools at 7 schools and about 2,441 students; Middlesboro and Pineville Independent are full K-12. Pineville Independent holds $4.99 million across 12 Department of Justice awards adjacent to IT-MSP work.
• Housing Authority of Middlesboro and Pineville Municipal Housing Authority

  Public housing authorities (HUD REAC and PIC)

  Institution

  $16.23 million across 25 HUD awards for the Middlesboro authority; $6.03 million across 13 HUD awards for the Pineville authority. Executive Directors have not been independently confirmed.
• Bell-Whitley Community Action Agency Executive Director (129 N Pine St, Pineville)

  Two-county CAA (Head Start, CSBG, weatherization, WIOA, and HHS-mandated client confidentiality)

  Institution

  $26.83 million across 3 HHS awards — the single largest Bell-PoP federal recipient.
• Middlesboro-Bell County Airport (KMBO) Airport Manager

  General-aviation airport (FAA AIP, AWOS, CCTV)

  Institution

  $1.35 million across 4 Department of Transportation awards. Minimal but extant IT footprint.
• KLC Buying Network, KIT (Commonwealth Office for Technology), KSBA cooperative bid, and Kentucky Office of Homeland Security SLCGP

  Procurement vehicles and state programs

  Out-of-county

  KLC group purchasing for cities; KIT master-agreement subcontract path; KSBA K-12 cooperative procurement; KOHS SLCGP pass-through.
• FBI CJIS Division, Kentucky State Police CJIS Liaison, KDE Office of CTE, and KDE district-cybersecurity-plan

  Federal and state compliance and standards

  Out-of-county

  CJIS Security Policy v5.9-to-v6.0 transition; KDE K-12 cybersecurity-plan guidance.
• Cyber-insurance carriers (KLC, Travelers, Beazley, Chubb, Coalition, At-Bay)

  Cyber-insurance underwriting attestation

  Out-of-county

  MFA, EDR, immutable backups, SOC monitoring, tabletop exercises, and security-awareness training; 2024 to 2027 renewal-cycle tightening.

Primary lane: a Bell-resident founder with a prior CJIS-qualified IT-security officer credential plus M365 Government Community Cloud tenant administration plus firewall and endpoint-security stack chops. Starts with 1 to 3 anchor accounts (Fiscal Court plus City of Middlesboro plus Bell County Schools is the natural anchor cluster) and stacks the remaining principals through the KLC Buying Network, KIT, KSBA cooperative bid, and chamber-and-Fiscal-Court relationship-building over Years 1 to 3.

Secondary lane: an existing Bell, Knox, Whitley, or Laurel IT-MSP firm extending into the Bell-resident multi-principal stack. An existing single-account or two-account MSP operator with KLC or KSBA pre-qualification adds Bell-resident principal accounts through the social-network density.

Procurement-vehicle posture. The KLC Buying Network is the city-side group-purchasing on-ramp for Pineville and Middlesboro and a cross-county expansion vehicle reaching roughly 370 Kentucky home-rule cities outside Bell. KIT master agreements (Commonwealth Office for Technology) ride to all ten principals through one credential when held as a sub to a KIT-prime systems integrator. The KSBA cooperative bid covers K-12 cooperative procurement at Bell County Schools, Middlesboro Independent, and Pineville Independent and broadens K-12 reach across Eastern Kentucky. The KOHS SLCGP pass-through sustains a project-overlay pipeline; the fiscal year 2026 SLCGP allocation should be verified through KOHS.

Vendor-continuity context. The Bell County Fiscal Court 2026 GOP primary (Albey Brock against Rick Nelson and Jeromy Killion, with a debate at the Bell Theater in Pineville on May 5, 2026 per Middlesboro Daily News procedural coverage) should not be assumed to carry vendor-relationship continuity past the primary outcome; a post-primary vendor-continuity review is queued.

• — Each principal's current incumbent MSP, contract terms, and renewal cycles. As of May 2026, these have not been independently confirmed and require direct outreach to each Fiscal Court office, Mayor's office, Superintendent's office, and Executive Director.
• — FBI CJIS Security Policy v6.0 transition timeline and Kentucky State Police CJIS Liaison interpretation. As of May 2026, these have not been independently confirmed.
• — Kentucky Department of Education district-cybersecurity-plan fiscal year 2026 specific scope and tabletop-exercise cadence for Bell County Schools, Middlesboro Independent, and Pineville Independent. As of May 2026, these have not been independently confirmed.
• — Architect-of-record cross-district check for Bell County Schools, Middlesboro Independent, and Pineville Independent. As of May 2026, this has not been independently confirmed against KSBA portal AgencyIDs or district business-office records.
• — Bell County Fiscal Court 2026 GOP primary outcome for vendor-relationship continuity. To be reviewed after the primary.
• — KOHS fiscal year 2026 SLCGP allocation and the Bell-eligible small-jurisdiction pass-through cycle. As of May 2026, this has not been independently confirmed.
• — Cyber-insurance carrier 2026 to 2027 attestation-tightening detail across KLC, Travelers, Beazley, Chubb, Coalition, and At-Bay. As of May 2026, this has not been independently confirmed.
• — Bell-Whitley CAA program-mix detail behind the $26.83 million across 3 HHS awards. As of May 2026, this has not been independently confirmed against BWCAA or HHS Office of Community Services records.

Tonight, this week, this month — in that order. Each step produces a yes/no or a number, not a deeper understanding.