Control systems are exposed to unintentional errors, deliberate intrusions, false
data injection attacks, and various other disruptions. In this paper we propose, justify, and illustrate a rule of thumb for detecting, or confirming the absence of, such disruptions. To facilitate the use of the rule, we rigorously discuss underlying results that delineate the boundaries of the rule’s applicability. We also discuss ways to further widen the applicability of the proposed intrusion-detection methodology