Criteria and Process for Feed Inclusion in Vulnerability-Lookup

If we go a bit further and look at best practice for feed generation, should we go for a BCP in GCVE or update BCP-02 to provide a set of recommendations?