If possible, basic efficacy testing is done on non-human models, either in vitro or animal models. For species-specific viruses, this is difficult and may be impossible. I'm not sure what if any such testing was done with the SARS-COV-2 vaccine candidates.

A basic safety test with dosages thought to be low enough not to present any risks. The goal here is simply to see what if any side effects occur. Any comorbidities, no matter how unrelated, are reported. Note that these may occur in a control / nontreated population, so the key isn't "individual was treated, had condition", but "there is a statistically robust difference in rates of co-morbidities between treatment and control populations" In normal circumstances, such safety testing may take a year or more, and data reporting are ongoing through drug development and use.

Efficacy is determined, where groups treated are assessed for whether or not the drug provides any measureable effect. Note that this can range anywhere from "provides 100% immunity from infection" to "cancer patient dies a horrible painful death 2 weeks after control group". (If you're familiar with cancer research, it is rife with very marginal "positive responses" to therapy. Yes, with some spectacularly better instances.)

Finally, dosing is dialed in to find out how much and how often to deliver the drug. That's how we're ending up with single vs. double innoculation recommendations, and/or boosters, and wait times between dosing. Again, multiple groups followed over time.

All of this takes time. Since COVID-19 has a course of about 1--2 months from exposure to resolution (you get better or you die), and vaccinations have a lead time of about 2 weeks after second dose to full efficacy, that's about four momths just to get baseline measurements.

A typical drug study might have as few as 30--60 patients, though many have more. In the case of the SARS-COV-2 vaccines, trials were much larger as I understand (I don't have data or reports in front of me, so don't take my comments here as significant.)

If there's earlier research to build off of (e.g., mRNA base models of solutions and methods) then some of this process can be based on earlier research, which helps.

But you're still looking at 6--9 months before a vaccine can be recommended with strong assurances even under highly expedited conditions. Given circumstances, health authorities might be willing to operate more quickly and with less data, but those decisions would have to be considered preliminary and subject to revision. Revised understanding around COVID-19 has been highly problematic around the world, leading to trust issues and opportunists spreading disinformation.

And once you have a candidate treatment, you've still got to produce and supply that, with manufacturing and logistics considerations, all of which were evident in the rollout of existing SARS-COV-2 vaccines (e.g., production issues, patent licensing, quality control, storage and refrigeration, cold-chain management, patient contact, scheduling, and follow-up, etc.).

It's complicated.

Source: Some ancillary PHARMA related work in the past, eccelctic interests.