Rick's raises a great point about redundancy. However, implementing what he describes can bump into a couple of issues especially if the authoritative source is a public Internet NTP source. First, you may not have redundant paths to the authoritative sources, and without that, you would still have a single point of failure. Second, Internet public NTP servers generally don't want to be hit by multiple downstream devices (to avoid overloading them).
Fortunately, though, network devices on-line and running don't time "drift" too much. I.e., if you lose your authoritative source, you devices will likely still have accurate enough time, for most purposes, for some time. (One issue is, devices that don't have an on-board "calendar". If they reboot, their time will be off. [If they do have an on-board calendar, when setting up NTP, you should configure it to occasionally sync it up too,])
What I don't recall is behavior if the the authoritative source is lost, whether downstream devices will still NTP sync their time with upstream devices. If they do, what Rick suggested would be great even if you couldn't get dual authoritative sources.
