Structural shifts in the Incident Command System (ICS) and communication networks during cyber incidents were analyzed through six Tabletop Exercises (TTXs) simulating a scenario with evolving priorities, from cybersecurity to operational safety. The early phase featured centralized coordination by the Computer Security Incident Response Team (CSIRT), while later phases exhibited a transition toward field-led, decentralized responses as safety threats emerged. Analysis of communication logs and participant surveys indicated that tools such as organizational charts and predefined workflows, although effective for cybersecurity phases, may become bottlenecks in safety-critical situations. Exercises involving culturally neutral, mixed-role participants enabled observation of ideal ICS transitions, free from organizational bias or authority constraints. Findings suggest that adaptive ICS frameworks, incorporating clear authority-transfer triggers and flexible communication patterns, are essential for timely incident response. Emphasis is also placed on psychological safety, which supports effective leadership transitions in high-stress scenarios. These insights contribute to the design of cyber-physical incident training and enhance resilience through phase-specific coordination models and human-centered preparedness strategies.