Given how long it takes to formulate something like this, it's more likely to be a response to the Sony hack.

Unlikely; these things usually take some time to do (advisors provide feedback, multiple edit sessions likely, reviewed by lawyers, etc). I can't see them pulling this out so quickly...though I guess it's certainly possible just seems unlikely to me.

I wonder if there is any data out there to show how long executive orders typically take from conception to execution.

Probably, and I hate knee-jerk reactions like this.

I don't think it's a knee-jerk reaction. For me it's easier to believe that this EO was signed deliberately to make every important security researcher guilty by default. It's hard to go against a government that can always punish you for what you have already done.