For buyers contracting authority
Pick 72212732 when the contract's deliverable is software written to protect data: encryption, access control, data-loss prevention, secure monitoring, or security features built into a bespoke system. The test is whether the work produces purpose-written security software rather than supplying a product or running a service.
The boundary that trips contracting authorities is the parent sibling 72212730, Security software development services. That code is the general security-software bucket; 72212732 is the narrower pick when the focus is specifically the data layer, data confidentiality, integrity, and controlled access, rather than security software at large. One step up, the parent 72212700 fits when the scope spans software-development utilities more broadly and no single security sub-category dominates.
Watch the operations trap. Where the contract is mainly a managed security service, threat monitoring, detection and response, a security operations centre run for the authority, the development codes are the wrong home and a managed-services or general security-services code fits better. Set the primary CPV code by the dominant purpose: a build points here; an ongoing service does not.