I can offer a UK perspective on this, using guidelines from the National Institute for Health and Clinical Excellence (NICE): Cardiovascular disease: risk assessment and reduction, including lipid modification. There is also a useful summary here.
You mention the case of secondary prevention in cardiovascular disease (CVD), when statins are used in people who have already got a diagnosis of vascular disease (e.g. heart attack or stroke). In the context of primary prevention, determining whether or not to use a statin comes down to assessing the risk of cardiovascular disease.
Several factors influence the risk of cardiovascular disease, including diabetes, smoking, family history, hypertension, dyslipidaemia (high cholesterol), obesity, age and sex, amongst others.
We can estimate the risk using an algorithm such as QRisk (the main one in use in the UK). This provides a 10-year risk of cardiovascular disease. You can experiment with values to see the effect different variables have (smoking is particularly significant). This algorithm is based on studies and meta-analyses referenced on the linked site.
The NICE guidelines recommend this:
Offer lipid-modification therapy to people aged 84 years and younger
if their estimated 10-year risk of developing cardiovascular disease
(CVD) using the QRISK®2 assessment tool is 10% or more.
Certain disease, such as adults with type 1 diabetes, familial hypercholesterolaemia and chronic kidney disease are recommended to be prescribed a statin regardless of calculated risk.
A 10% 10-year CVD risk means that if we had 100 people exactly like the person in question in every way and followed them up over the next 10 years, we would expect 10 of them to have had a cardiovascular event (such as a heart attack or stroke).
Before easily accessible algorithms embedded in web apps, charts such as the one below were used. They are quite useful for showing the factors that contribute to cardiovascular disease risk.
