[TomL.]

You can set cvars via the server.cfg which will be executed on server start.
If you manually want to set cvars like sv_password via the server or client console and have the change re-applied after a server restart you will need a plugin.

If you have the cvar sv_password only set in your server.cfg, the cvar should be only overriden on server start not on map change because, as far as I know, hlds doesn't automatically executed the server.cfg after changing map.