Is this true? There are plenty of NATO systems that seem to be dual homed and accessible from internet either through port forwarding or VPN. That’s not “physical separation”.

Upper management. Everywhere they want the rank & file to stop WFH and come back to office.

More like people who can't. Working with sensitive documents sometimes requires physical engineering considerations (ie: viewing rooms). Not something that can be replicated in an employee's home. Contrary to what software devs like myself like to think, not every job can be done remotely!

DoD has a parallel internet inaccessible from outside secure sites. They can follow the same approach with NATO computing needs.

Not if your private environment is large enough that you can create individual cloud platforms inside of it. One level more detached than AWS GovCloud / whatever Ali does.

The contractors would likely never touch the live system. Just deliver the project to deploy.