What should the markup be? What you say sounds very high indeed, but there is a certain markup that will be required. Why? Operating a commissary in a prison is more complex than a local convenience store

(I'm making some assumptions here) each bag of Cheetos needs to be individually inspected to make sure that nothing is being smuggled into the prison. This would go for every item being sold into the prison.

It would be interesting to see what would happen if there was competition in selling into prisons, but my guess is you'd end up with some kind of split duopoly at best where things would be about the same as they are now. The reason is that no one can just establish a new business, which is the most important thing for creating competition.