Assurance

[Tom Scavo <>]

> If a Silver credential is compromised, can or should it be reset
> using the compromised credential

If a credential is compromised, it needs to be revoked ASAP, that is, it 
should no longer be recognized as a valid authenticator.

> and/ or by answering security questions?

I don't believe the IAP gives guidance in the area of password reset (which 
is what I think you're asking about) so let me give my opinion FWIW. A 
password is only as strong as the password reset mechanism that goes along 
with it. Recent events on the open Internet have clearly demonstrated that 
the Bad Guy, when confronted with a strong authenticator, turns his/her 
attention to the password reset process using social engineering tactics.

Tom