What is the time frame to implement each of the requirements of the "ISA"?
As soon as possible. That having been said, The California Area Office will be doing annual testing in August, 2007 and risk assessment in September, 2007. That would probably be a good target to aim for.

California Area Office