The point in time to which data must be recovered after an outage. Response:

The Recovery Point Objective (RPO) specifies the maximum allowable amount of data that can be lost from an IT service due to a major incident or disruption. It dictates how far back in time data recovery efforts need to go, meaning if an RPO is 4 hours, data must be recoverable to a state no older than 4 hours before the outage.

Active Security Testing (AST) refers to techniques for testing the security of systems and applications while they are running, unrelated to data recovery timeframes.

Internal Security Testing (IST) is a type of security test conducted from within an organization's network, unrelated to data recovery metrics.

General Support System (GSS) is a categorization of an information system that provides common services, not a recovery objective.