Risk assessment is a management challenge. Triage and litigation, if Y2K problems result in safety, security and core mission failures will be a management challenge. Don't be Chicken Little - you'll lose credibility immediately. Educate yourself, then top management on what can really happen if your mission critical systems fail, starting with fire alarms, E-911 and intrusion detection security system disaster scenarios. Once management understands, it's easy to get their support for firm target milestones and determine the bill payer up front.
Measure progress frequently against target milestones, and keep management informed.
Having top management sign monthly certification memos resulted in them owning the program, which is essential in placing a high priority on Y2K fixes. Determine your funding strategy up front. Y2K a must fund in your budget guidance. If you've waited until FY99 to purchase fixes, don't be surprised that vendors are backlogged on orders as most businesses and states start their fiscal year in July. Be aware of, and quickly work through, any regulatory and statutory fiscal hurdles.