Aside from setting a password with the sv_password cvar in your server.cfg there is another way to make your server private, and that is to associate it with a “steam group”.
The advantage of this method is that you can invite players to your steam group and only those players will be able to play on the server – they will also see steam group servers when the game loads (so your server should be easy to join).
So the first step is to create a steam group. Once this is created the group admin (the person who created the group) will need to click on Admin Options and then Edit group profile to get the steam group ID.
Once you have the steam group ID you can edit you server.cfg as follows, (where ###### is your steam group ID):
sv_allow_lobby_connect_only 0sv_steamgroup ######sv_steamgroup_exclusive 1
Then just invite your friends to the steam group and everyone should see your server listed in-game just like this: