Control systems are exposed to unintentional errors, deliberate intrusions, false data injection attacks, and various other disruptions. In this paper we propose, justify, and illustrate a rule of thumb for detecting, or confirming the absence of, such disruptions. To facilitate the use of the rule, we rigorously discuss background results that delineate the boundaries of the rule's applicability. We also discuss ways to further widen the applicability of the proposed intrusion-detection methodology.