Each office/unit must prepare and maintain a Business Continuity Plan (BCP), to ensure that the organization can carry out its functions, so far as is reasonably practicable, when faced with an emergency. The BCP must be reviewed annually. The BCP covers all UNDP-administered personnel, business functions at all levels, including those that have been subcontracted to external contractors and suppliers, where the overall legal responsibility remains with UNDP. The BCP does not cover third party resilience; however, subcontractors should be asked to provide evidence that they have considered potential resilience issues. Project offices are also encouraged to apply the principles of BCM. 16. The BCP follows International Best practices, ISO 22301 (Societal Security – Guidelines for Incident Preparedness and Operations Continuity Management).