The Birth and Death of the Orange Book (2015) [pdf]

The Orange Book / NSA approach to evaluation upset many vendors. The original policy, borrowed from safe and lock evaluation, was that vendors got two tries at security evaluation. For the first try, the evaluators told the vendor what problems they'd found. The second try was pass/fail, and failure meant rejection of the product. Published, public rejection as defective. A few systems did pass, but they were well out of the mainstream. Prime Computer had a secure operating system for their minicomputers. Most failed. Computer vendors hated that.

This resulted in demands that evaluation be outsourced to "third party labs" paid by vendors, instead of NSA employees. The third party labs could be paid to retest and retest until the thing passed. This was pretty worthless. There was even a demand from vendors that NSA stop promoting the higher levels of assurance as inappropriate to the commercial market.

Computer security was not a big issue within NSA at the time. They were still all about radio interception and analysis, and focused on the USSR. NSA's main facility is at Fort Meade, MD. There was (and still is) an auxiliary facility called Friendship Annex or FANX, near Friendship Airport, now Baltimore Washington International. FANX handled low-priority NSA functions, such as personnel and training. Being assigned to FANX was low-status within NSA. Computer security was at FANX. The location alone made it something of a career backwater. This had a non-trivial effect on the effort.