That will do the trick.
I just tried on my system and a literal:
$ tar cvzf cvs_backup.tar.gz $CVSROOT
works fine. You can try:
tar cvzf cvs_backup_`date +%d-%m-%y`.tar.gz $CVSROOT
if you want the date appended. Don't forget to use 'p' if you ever need to restore it.
Again, bear in mind this is only the latest checked-in data, it doesn't account for .cvsrc, .cvsignore files etc, and any code in a local tree which has not been committed.