ccs-review-process

CCS Review Process

Use this to reason about review-stage strategy. Reopen the current CFP, the cycle's HotCRP site, the reviewer guidelines if posted, and the ethics policy before making process claims.

Process model

• CCS runs two review cycles per year on HotCRP, each with abstract registration, full-paper submission, review, a rebuttal window, and notification.
• Reviewers assess threat-model soundness, novelty, technical correctness, evidence quality, ethics and responsible disclosure, and significance to the security community.
• Decisions are not binary: CCS 2026 used accept, minor revision (authors revise for the same cycle under a shepherd or check), and reject. A first-cycle reject cannot return that year.
• An ethics or disclosure concern can sink an otherwise strong paper; the ethics reviewer's view carries weight independent of technical scores.
• Accepted papers publish in the ACM Digital Library proceedings, so camera-ready and metadata compliance matter as much as the initial decision.

Who reviews here

• The pool is adversarial by training: expect at least one reviewer to attack your threat model, look for the assumption that makes the attack easy, and probe whether the defense was tested against an adaptive attacker.
• CCS is broad, so a paper may draw reviewers from an adjacent sub-area; the threat model and intro must orient a web-security reviewer to a crypto result and vice versa.
• Borderline papers usually fall on one of three edges: an attacker assumption too strong to be interesting, a defense never adapted against, or an ethics gap left unaddressed.

Scoring leverage table