Both report types require the same multi-month build phase. A Type I can be issued as soon as that build is done. A Type II additionally requires an observation window of six to twelve months before it can be issued.
Writing policies, configuring systems, running access reviews, setting up monitoring. A few months for most teams.
Six months for a first report, then twelve months every year after. Cannot be shortened.
Can be issued as soon as the controls are ready.