The ROS_ROOT environment variable will only be defined if the ROS setup.bash (e.g. /opt/ros/<distro>/setup.bash) has been sourced in the environment from which CMake was called. So for this solution you need guarantee that, if there is a ROS install, the ROS setup.bash was sourced before calling cmake.
Alternatively, if you know ROS was installed from a debian package and not from source, you can check if the folder /opt/ros/<distro> exists. However this solution is not entirely portable.