An network management system (NMS) architecture is disclosed that takes advantage of intelligence capable network devices for network monitoring and control. NMS functions may be distributed where possible to intelligent devices where local storage and processing may be performed. Local collection and processing of monitoring information may reduce NMS-related network traffic, permit continuing local control and operation during times of network communication disruption with the central NMS, and permit greater reliability in data collection and execution of network functions such as the enforcement of security policy at the respective intelligent devices.