There is a rapidly growing interest in the security of cyber-physical systems (CPS) and internet-of-things (IoT) in industry, government and academia. NIST recently created a Cyber-Physical Systems group and it is leading a public-private initiative to identify a general architecture, design principles, solutions, and challenges ahead. In Europe, the Horizon 2020 research program has targeted security issues relating to cyber-physical infrastructures and Internet of Things, while the fundamental science program CHIST-ERA launched calls for research projects on resilient trustworthy cyber-physical systems (2015) and user-centered security and privacy in the Internet of Things (2016). In the US, grant calls such as the 2019 CPS grant call by NSF (total of 50M USD) show the significance of CPS&IoT and their security. In 2019, CCS accepted two workshops: One on CPS security and privacy (running 5 times in the past) and one on IoT security and privacy (running 2 times in the past). Since the topics are connected and there is some significant overlap, the Steering Committees of the two workshops have decided to merge towards delivering a world-class event on CPS&IoT security and privacy.