An effective exercise program is not a single, isolated event but a structured and progressive series of activities scheduled over a defined period. This programmatic approach allows an organization to build and mature its capabilities incrementally, often starting with simpler exercises (e.g., tabletop discussions) and advancing to more complex simulations. The purpose is to validate different components of the business continuity management system (BCMS) over time, train personnel, and foster a culture of continuous improvement. This ensures that all critical plans and teams are eventually tested and that the organization's overall resilience is enhanced.

B. Exercises must be conducted periodically as part of a continuous improvement cycle, not just once, to validate changes and maintain readiness.

C. A variety of exercise types are necessary to test different aspects of plans and team capabilities effectively; a single type is insufficient.

D. A comprehensive program should aim to cover all critical plans and recovery teams over its lifecycle, not just a limited, unrepresentative sample.

1. Business Continuity Institute (BCI), Good Practice Guidelines (GPG), 2018 Edition: In Professional Practice 5 (Validation), Section 8.3, "The Exercise Programme," states, "The exercise programme is a series of scheduled events and activities designed to practise, test, and review BCM plans and capabilities." This directly supports the concept of a series of events over time.

2. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements: Clause 8.5, "Business continuity exercise programme," requires the organization to "establish, implement and maintain a business continuity exercise programme." The standard also notes that the programme shall "be varied over time in terms of type and complexity," which contradicts the single-type approach in option C.

3. NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities: Section 3.1, "TT&E Program Strategy," emphasizes the need for a "multi-year TT&E program strategy" that uses a "building-block approach," progressing from simple to more complex exercises over time. This aligns with the correct answer and refutes the notion of a single exercise or type.