ISC2 identifies lack of change control as a common cause of security failures in its Common Body of Knowledge (CBK). It includes a section on Security Operations, which covers topics such as change management, configuration management, and incident management. Within this section, lack of change control is identified as a common cause of security failures. Additionally, many other sources in the field of information security also identify lack of change control as a common issue that can lead to security incidents.