The Real Standards Behind IT Automation: Redfish, ISO 20000, POSIX, and TOSCA

IT automation looks like a purely practical, tool-driven discipline, scripts, schedulers, and monitoring agents, but there is a real standards layer underneath it that governs how systems expose themselves to be automated and how automation programs are supposed to be run as a disciplined process rather than ad hoc scripting. Here is what actually governs this space.

The standard that lets automation talk to hardware directly

DMTF Redfish is the modern, REST-based standard for out-of-band server management, power control, health monitoring, firmware updates, that has largely replaced older proprietary IPMI-based tooling. If your automation scripts talk to a server’s BMC (Baseboard Management Controller) to check hardware health or trigger a remote power cycle without an OS being up, there is a good chance you’re already calling a Redfish API under the hood. DMTF (the Distributed Management Task Force) also maintains the Common Information Model (CIM), a broader standard for describing manageable IT resources in a vendor-neutral way.

IT service management as a formal discipline

ISO/IEC 20000 is the international standard for IT service management, covering how incident response, change management, and (relevantly) automated remediation processes should be documented and controlled. If your organization has ever been audited against ITSM maturity, this is very likely the standard being measured against. It pairs with ITIL (the practical framework, not itself an ISO standard but the most widely adopted implementation guidance for these same ideas), maintained today by AXELOS/PeopleCert.

Portable scripting standards

Anyone automating across mixed Linux/Unix environments is leaning on POSIX (IEEE 1003.1, maintained jointly with The Open Group) whether they realize it or not: it’s the specification that defines standard shell behavior, meaning a script written against POSIX-compliant syntax behaves predictably across different Unix-like systems rather than only on the one distro it was written on.

Cloud and infrastructure orchestration standards

• OASIS TOSCA (Topology and Orchestration Specification for Cloud Applications): a standard way of describing infrastructure and application topology so orchestration tooling can automate deployment consistently across different cloud platforms rather than locking into one vendor’s proprietary format.
• Cloud Native Computing Foundation (CNCF): governs Kubernetes and a large share of the modern container orchestration ecosystem that most current infrastructure automation is built around.

Why formal standards matter for something that feels like “just scripting”

The practical payoff of knowing this layer exists is portability and auditability. A remediation script built against a documented, standard API (Redfish, a POSIX-compliant shell, a TOSCA-described deployment) keeps working when you change hardware vendors or cloud providers. A script built against one vendor’s undocumented internal behavior breaks the moment that vendor changes something, with no spec to hold them accountable to.

Frequently asked questions

Do I need to be ISO/IEC 20000 certified to build good automation?
No, certification is an organizational process, not a personal requirement for writing good scripts. But understanding the change management and incident lifecycle concepts it formalizes (the same detect, diagnose, remediate, validate, close pattern covered in the agentic AI automation post on this site) makes your own automation more disciplined even without a formal audit ever happening.

Is Redfish something I need to learn if I only manage cloud VMs, not physical hardware?
Not directly, since cloud providers abstract the physical layer away from you. But if your organization runs any on-premises or colocated hardware alongside cloud resources, which is common in hybrid setups, Redfish is very likely already running underneath whatever hardware monitoring tool you use, and knowing the standard helps you evaluate or troubleshoot that tooling directly.