There are multiple layers of backup.
If the master site (the overall system controller) fails, or the links between the master site and zone controllers fail, the zone controllers take over controlling their respective zones; the only thing that's lost is roaming between zones.
If the zone controller fails (or the links to the sites fail), each site goes into site trunking and acts as its own controller. If one site goes into site trunking, all the radios on that site move to one that's in wide-area mode. If multiple sites (or the whole system) go into site trunking you've got a problem; when your users are scattered among several sites and they all go into site trunking, users may not be able to communicate with each other because they're spread out among various, suddenly-disconnected sites.
If the site controller fails, the site goes into failsoft, where each frequency at the site becomes a conventional repeater, and specific talkgroups are assigned to specific frequencies. On a system like MARCS, failsoft really only works if talkgroups use a single site and do not roam; otherwise talkgroups wouldn't be able to find their assigned failsoft frequencies if they're not on the correct site.
While MARCS is a highly reliable system, it's important for agencies to have some sort of backup available, in the event of the worst-case scenario (complete system failure).