1. A method for detecting and analyzing changes to an IT system and its security, the method comprising: reading a current or previously stored evidence version relating to the IT system; normalizing the current evidence version; storing the current evidence version; reading one or more previously stored versions of the normalized evidence; identifying differences between the read normalized evidence versions; and determining whether a change has been detected based on the identified differences between the read normalized evidence versions.