Yes, if an incident involves an internal legitimate user where the account has been used to perform some unauthorized activity or user action mandates immediate cessation of access, the ACSIA administrator can immediately block that specific user.