Rather than "NIH" solutions, I think that such businesses commonly choose products that can be hosted on premise.

There's also MS Government Cloud: https://azure.microsoft.com/en-us/global-infrastructure/gove...

Its not so much that you need to have your own, its just much more complicated to do it in the cloud. When you have to be able to prove by audit that only US persons are authorized to access the datacenter and that only US persons have accessed the datacenter then you need a provider willing to do that as well as contracts, policies, and procedures. It all needs to be audit-able and evidence based. If you need to do these things in the cloud then you need to do them in-house too. Which means that you already do the basics in-house making it attractive to do things in-house.

Take Confluence for example, if I use the cloud version I can't store any files there or have any information about certain projects. But I can run the same Confluence in-house and then we can share project details. As you point out, its not always that easy.